In most cases `Access-Control-Allow-Origin: ` is actually a decent policy. It importantly blocks cross-site credentials. So as long as your API has any* authent

In most cases `Access-Control-Allow-Origin: ` is actually a decent policy. It importantly blocks cross-site credentials. So as long as your API has any* authentication it should prevent it. The real mistake is mirroring the Origin header from the request in the `Access-Control-Allow-Origin` response header which allows credentials (unless you add other headers) Of course this all relies on you not accepting form posts without auth.