Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

You need to have a super great reason to disable CORS, as no real reason was given here the answer should be “do not do it, it is not secure”.

You assume that no one can craft a feed link which will give him a write access. This might be true, but you should not open holes in your security based on “assuming”.

In the very least, if some other domain needs “AJAX” access to your feeds, you should disable CORS only for that specific domain.

In addition pre_get_posts is totally the wrong place to do it, and you should do it on init. The way your code is currently written it may disable CORS for pages which are not feed.

Related Posts:

  1. HTTP Security Headers in wp-config
  2. Restricting access to content
  3. Downloading File from Outside Web Root
  4. 404/500 error on content images if Referer header is from another domain [closed]
  5. User generated content and security
  6. What is the difference between a cer, pvk, and pfx file?
  7. How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
  8. Is it possible to decrypt SHA1
  9. Simplest two-way encryption using PHP
  10. Error `sec_error_revoked_certificate` when viewed in Firefox only
  11. Convert .pfx to .cer
  12. Why should I use the esc_url?
  13. How safe / sanitized is wp_insert_posts()?
  14. Where to securely store API keys and passwords in WordPress?
  15. Why escape if the_content isnt?
  16. Full path disclosure on rss-functions.php
  17. What to use instead of wp_kses() in user output
  18. Are the default salts secure?
  19. is_email() VS sanitize_email()
  20. Subscribe to email for security fixes?
  21. How to escape custom css?
  22. Understanding SVG vulnerabilities in WordPress related to a specific fix
  23. Moving wp-config.php: Can this be done after site launch?
  24. How to secure or disable the RSS feeds?
  25. Regular security checks – what steps should be included?
  26. Make password invalid once logged out of password-protected page
  27. How to get WordPress to save upload file beyond web root [closed]
  28. Is security a problem in WordPress?
  29. Do you need to escape hard coded plain text?
  30. Moving wordpress out of the public directory
  31. Logout via Subdomain, non-wordpress page on a different server?
  32. Protecting HTML5 video [closed]
  33. How can I tell who changed the password?
  34. WordPress website Security [closed]
  35. Do I need to use the esc_html() function on hard coded links?
  36. Can’t reset WordPress password
  37. Is the “lost password” feature truly a vulnerability?
  38. Frontend Password change
  39. Is it possible to reduce the minimum character length for passwords?
  40. Handling email piping attachments and detecting unsupported file types
  41. site get login attempts after htaccess ip restriction
  42. Is it good security advice to install wordpress in subdirectory but link to root?
  43. Why was my blog post inserted lot’s of ad links by others?
  44. Moving wp-config.php up 2 levels
  45. How Could I sanitize the receive data from this code
  46. WordPress SQL Injections through User Agent
  47. Should I Worry About SQL Injection When Using wp_insert_post?
  48. Is there a way for a user to have an alias?
  49. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  50. What permissions should I give directories if I want to make WordPress more secure?
  51. Security threat with `home_url`?
  52. When is wp_set_password() called or how to capture a password
  53. How to protect wp-admin through .htaccess?
  54. Something is unescaping all html entities before output to browser [closed]
  55. Good way to block users within a multisite setup without deleting them?
  56. Is wp_kses the right approach in sanitizing this string?
  57. Reset Password policy
  58. Renaming install.php for security?
  59. Limit Login Attempts BEFORE PHP is executed?
  60. Which Versions of WordPress Ship with the Patched TimThumb?
  61. Safe to say WordPress security releases don’t have database upgrades
  62. Use global variables or function that returns said variables for site-wide private-ish WP settings?
  63. Add access control origin header information across multisite
  64. fail2ban to prevent Brute Force Attacks on WordPress?
  65. Use Google authentication for pages within a website [closed]
  66. How to give the same error message when the wrong password or wrong username is used?
  67. Why does WordPress change a file’s permissions?
  68. should I escape a literal url added in functions.php
  69. Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
  70. Adding Security Keys?
  71. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  72. Secret keys in SCM
  73. Secure Server after configuration
  74. Uploading attachment (pdf) and prevent download for anonymous user
  75. After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
  76. How to make WP page accessile only to specific user roles
  77. hide theme files for admin beneath root
  78. Specific Page/Post Need to Stay Non SSL
  79. Block JSON access over the net
  80. Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
  81. Scan multiple websites for malware that are in same webhost root?
  82. The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
  83. Security: AWS (shared hosting) claims template file malicious
  84. Cannot access wp admin of WordPress website (security plugin issue) [closed]
  85. How to check whether a site has been compromised without browsing into it?
  86. My site thinks it’s secure when it is fact not
  87. Is it possible to only have the admin interface bind to the local loopback?
  88. PHP Code Sniffer – WordPress VIP Coding Standards
  89. Trying to understand nature of hacking
  90. Default installation permissions for wp-config.php
  91. Correct setup to block file modifications from hackers
  92. Is my WP site being hacked?
  93. Directory to store secure file
  94. How can I give someone server access to only duplicate and modify a site?
  95. WP-JSON: Cross Origin Resource Sharing Vulnerability?
  96. How can I implement ansible with per-host passwords, securely?
  97. Why should I firewall servers?
  98. Does drilling a hole into a hard drive suffice to make its data unrecoverable?
  99. Can you alter the default wordpress strong password requirements?
  100. how to sanitizing $_POST with the correct way?