You should note the following when you configure cross-origin resource sharing (CORS) on your server.
Define appropriate access lists
It is always best to grant access to individual domains using comma-separated lists. Avoid using wildcards unless you want to make the API public. Otherwise, using wildcards and regular expressions may create vulnerabilities.
For example, let's say you write a regular expression that grants access to all sites with the suffix permitted-website.com. With one expression, you grant access to api.permitted-website.com and news.permitted-website.com. But you also inadvertently grant access to unauthorized sites that may use domains like maliciouspermitted-website.com.
Avoid using null origin in your list
Some browsers send the value null in the request header for certain scenarios like file requests or requests from the local host.
However, you shouldn’t include the null value in your access list. It also introduces security risks as unauthorized requests containing null headers may get access.