Is it possible for a attacker to spoof the Access-Control-Allow-Origin header?

Or, is it secure enough to protect resource access via the Access-Control-Allow-Origin header?

I'm trying to make an API key useless on certain domains, like the linked in JS API.

  • Just to clarify: what exactly do you mean by "spoof the header?"
    – Joel L
    Nov 30, 2013 at 15:46
  • I mean : can you manually send a request with fake origin header? as far as i 've read in these days yes, as also Rook pointed out.
    – Guido
    Nov 30, 2013 at 17:17
  • 'curl --header "Origin: HELLOWORLD" www.google.com' — Boom, request sent w/ random Origin header. It's up to the client (that is: browser) to enforce any restrictions.
    – Joel L
    Nov 30, 2013 at 19:36

1 Answer 1


If an attacker can control the access-control-allow-origin header then they can carry out much worse attacks than just modify this header element. For example an attacker could carry out a Man in the Middle attack, but authentication tokens, like cookies are a more desirable target.

An attacker could introduce their own access-control-allow-orign header using HTTP Response Splitting, but at this point they can control the entire header and the body. An "allow-orign" doesn't help with the entire Same-Origin Policy is undermined by an XSS vulnerability.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.