CORS Wildcard in Production? The Escape Room Countdown

2026-10-30

The timer on the wall says 41:12. Someone in your group is reading a riddle aloud about a clock with no hands. You are standing in a fake library, holding a brass key that doesn't fit anything yet.

Your mind isn't in the room.

It's in a terminal tab you left open this morning. Three words from a response header: Access-Control-Allow-Origin: *.

You put that wildcard there three weeks ago, in a hurry, to stop a browser error. You told yourself you'd fix it before launch.

Launch is Monday.

The key that fits nothing

Let's call you Mara. You're a freelance backend developer, and this is an illustrative scene, not a real person's story. The client runs a small yoga studio chain, and the booking API you built is the quiet engine under their new app.

It works. You've watched it work. Bookings go in, confirmations go out, the client sent a heart emoji on Thursday.

But "it works" is not the same as "I'd bet my name on it."

A friend on the team asks you something about the riddle. You say "mm, maybe the clock." You're not listening.

You're thinking about the endpoints. Were all of them behind the login check? Or did you leave a few open while testing, the way you do, and never go back? Is there a route that returns a list of bookings if you just ask politely?

You can't remember. That is the worst part. It's not that you know something is wrong. It's that you don't know it's right.

What the doubt quietly costs

Nobody warns you about this kind of worry. It doesn't announce itself. It sits behind the conversation, like a fridge hum you only notice when it stops.

It costs you the Saturday. You laugh at the right moments, but half of you is running a loop: wildcard, open routes, wildcard, open routes.

It costs you the Sunday evening too, because you'll open the laptop "just to check" and spend two hours poking around with no plan, no list, and no way to know when you're done. You'll find a few things, feel worse, and not know if you've found them all.

And it costs you something less visible: the feeling of being a professional. You're the one the client trusts with their customers' names and phone numbers. Somewhere in you, a small voice says a real engineer would have a clear answer to "is this safe to launch?" and you only have a feeling.

The feeling is not great.

The room you didn't solve

The group escapes with ninety seconds left. Everyone cheers. Someone takes a photo of you all holding the little "We made it" sign.

You smile in it. Later you'll look at that photo and remember the header, not the victory.

Outside, waiting for a tram in the cold, you do something small. You open a note on your phone and type: What exactly am I worried about?

And you notice that once the worry has to be written down, it gets smaller. It isn't "the API might be unsafe." It's a handful of specific questions. Who is allowed to call this from a browser? Which routes need a login, and do they all have one? What does an error reveal to a stranger?

The fog was never one big thing. It was many small unchecked boxes, all blurred together because none of them lived anywhere.

That's the turning point. Not a clever trick. Just the realisation that the doubt doesn't need more worrying. It needs a list, one that someone has already thought through, so you aren't inventing your own at 2 a.m. and hoping you remembered everything.

A different Monday

Picture the other version of this weekend.

On Saturday morning, before the escape room, you sit down with coffee. You go through a checklist one item at a time. Some items pass at once. A couple don't, and you fix them while they're still small. The wildcard gets replaced with the one address that should actually be allowed. The routes you weren't sure about get a clear yes or no.

By lunchtime the page has an honest tick or a note next to every line. You know what you checked and what you didn't. There's no more loop.

Then the escape room is just an escape room. You read the riddle. You get the clock thing right, loudly, and your friends tease you for it.

On Monday the client sends the launch message and you read it with a steady stomach. When they ask, "Is it secure?", you don't say "I think so." You send a short, tidy report of what was reviewed. It's calm and specific, and it looks like something a careful professional would hand over.

You close the laptop at six. The fridge hum is gone.

If you recognised yourself

If you've got a launch coming and a quiet doubt about a wildcard header or a few routes you can't swear to, you don't have to carry that around by memory.

We made the Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit for exactly this moment. It's a 58-item API review kit: a PDF, an XLSX tracker, curl tests, an auth-route scanner script, and a client report template, for Node/Express and Python. It's a way to get from "I think it's fine" to "I checked, and here's what I found." It helps you organise your review. It doesn't replace a professional security audit, and the decisions stay with you.

It carries our 30-day money-back promise: if it doesn't help, you get a full refund, no questions.

Have a look at the checklist kit here

An illustrative story, written with AI assistance.