What risk arises from misconfigured CORS?

• A. Faster cross-origin requests
• B. Increased security
• C. Unwanted cross-origin access to resources
• D. No risk

Answer: (C)

Understanding CORS means recognizing how browsers enforce cross-origin requests and how the server controls them with headers like Access-Control-Allow-Origin. If these headers are misconfigured, it can allow other websites to access your resources without permission—for example, using a wildcard origin or reflecting the incoming origin in the response. That leads to unwanted cross-origin access, potentially exposing sensitive data or credentials to unintended sites. The other options don’t describe the actual risk: misconfiguration doesn’t inherently speed things up, it reduces security rather than increases it, and there is indeed a risk if CORS is wrong.