Repair CORS Origin Validation Bugs

The problem

Inconsistent CORS and Origin validation across different application layers often leads to security vulnerabilities or broken client requests. Discrepancies between proxy headers, application parsers, and validation logic create unpredictable trust boundaries and leaky state.

What it does

• Identifies and maps trust boundaries across origin parsing, allowlists, and preflight handling.
• Normalizes origin matching for exact, wildcard, and null origin scenarios.
• Synchronizes CORS state ownership between proxies and application backends.
• Implements deterministic local fixtures and focused regression tests for CORS policies.
• Aligns Vary headers and metadata to ensure correct caching and credentialed access.

Why this beats prompting it yourself

General prompts often suggest insecure workarounds like broad wildcards or disabling validation to "fix" errors. This skill enforces strict adherence to existing authorization and credential policies while fixing the underlying architectural mismatch between components.

Use cases

• Fixing mismatched origin validation between an Nginx proxy and a Node.js API.
• Repairing broken preflight cache policies in microservices.
• Correcting Vary header metadata to prevent cross-origin credential leaks.
• Implementing deterministic test suites for complex wildcard origin matching.

Known limitations

Requires local repository access via filesystem tools. Cannot interact with production environments, live secrets, or real customer data.