Access-Control-Allow-Origin has a different meaning than simply preventing CSRF: It prevents that the requesting script can get the result of the request.
The same applies to
Access-Control-Allow-Credentials. This header allows that the script get the response of a request with credentials. Note that you can't use the wildcard
Access-Control-Allow-Origin when sending
Access-Control-Allow-Credentials: true. but you could just use the value of the
Origin request header.
The implication is: What could a script with the contents of your site do?
- If the user is logged in, a script can get all the sites that the user can see, parse it and send the (maybe confidential) data back to it's origin.
- If you include some kind of anti-CSRF-token in forms/links, they could get the value of the token and do a request with that valid token.
- It can act on the page on behalf of the user.
For XSS it depends what you mean with XSS. If you mean with XSS that an other script acts on bealf of a user, then you already allowed that.
So while adding to a remote site only reveals a few informations to the origin site (like the time to load it), the information leak (esp. for users that are logged in) can be much higher.
As a side note: Use the
Origin header if present to block requests.