Hello, I need to discuss a CORS issue with our authentication subdomain. Who can help? Something like the below is allowing requests from any domain

curl -D - -o /dev/null \
  -H "Origin: <https://evil.example.com>" \
  "https://{<http://auth.app.customer.com|auth.app.customer.com>}/v1/auth/refresh?dcs=t&dcr=t"

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. Understanding the CORS Concern Descope's auth APIs are hosted on

<http://api.descope.com|api.descope.com>

(or your custom domain if configured). CORS behavior is governed by standard browser security mechanisms — using a wildcard (

*

) in

Access-Control-Allow-Origin

is a known risk, specifically because: • It is not allowed when credentials (cookies, auth headers) are involved — the browser will block it. • It should only ever be used for fully public APIs, never private/authenticated ones. • When credentials are in play, the server must return a specific, explicit origin. What You Should Check & Configure 1. Approved Domains in Project Settings Navigate to Project Settings → Security → Approved Domains in the Descope Console. • This is a whitelist of domains allowed for redirect and verification URLs across authentication methods. • Leaving this empty disables validation and creates security vulnerabilities. • Enter only your trusted application domains (e.g.,

<http://example.com|example.com>

— without the protocol). 2. CORS Best Practices for Production • Use explicit origin allowlists — never

*

for authenticated flows. • Restrict allowed HTTP methods (e.g., GET, POST) to further limit points of entry. • Always use HTTPS to avoid potential security vulnerabilities of plaintext HTTP. • Regularly audit and log traffic to Descope domains to monitor for anomalies or unauthorized access attempts. For more detailed guidance, you can refer to the following resources: • Four Common CORS Errors and How to Fix Them • Configuring Custom Domain with CNAME | Descope Documentation • Firewall Configuration | Descope Documentation

If this is security issue, better send email to security@descope.com

This is set. Does this get utilized if cookies aren't enabled? I'm going to work on enabling cookies for auth, but just trying to figure out if origin should be locked down tighter regardless