Is it considered as secure for an application to set a header
access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS code? E.g.:
GET /application/secretStuff X-Authorization-Key: aaa X-Authorization-Secret: bbbb
This means that if an external malicious code tries to make a call to this URL it will be able to see the response, but this will be an authorization error anyway.
I understand there is at least one important drawback with this, namely the increase of the attack surface. But I'm looking to understand if this approach has other major problems.