FrontendHaltBrowser internals·Intermediate·Conceptual·1 min read
Why is reflecting the Origin header back as Allow-Origin risky?
Short interview answer
It effectively grants every origin read access to the response, which defeats the purpose of the policy. A safe implementation validates the incoming Origin against an explicit allowlist before echoing it back.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.