Hacksplaining Log in

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

A developer needs to test the API locally, so they temporarily disable CORS restrictions to make debugging easier. They accidentally commit the change with a TODO note, forgetting to revert it before production deployment.

repo.securebank.internal/api/commits

📁 SecureBank Repository

Internal code repository - API project

💥 Fix CORS for local testing
dev-intern committed 2 hours ago
+origin: '*' // TODO: remove before prod
✅ Add transaction endpoint
senior-dev committed 1 day ago
CORS Configuration
JavaScript 
// CORS middleware configuration
app.use(
  cors({
    origin: true, // reflects ANY request origin -- TODO: remove before prod!!
    credentials: true,
    methods: ['GET', 'POST'],
    allowedHeaders: ['Content-Type', 'Authorization'],
  }),
);