From 9422f695b3a5b3aff70b20ada449701465bf7334 Mon Sep 17 00:00:00 2001 From: Santhi Prakash Date: Wed, 23 Sep 2026 15:36:07 +0000 Subject: [PATCH] docs(security): stop presenting CORS as an XSS defence Problem: docs/operating/security.md told operators to set CORS headers to prevent XSS. CORS relaxes the Same-Origin Policy and is not an XSS defence (#2449). Fix: reword the CORS sentence so it no longer presents CORS as an XSS control. Verification: confirmed the stale wording on the target page. Signed-off-by: Santhi Prakash --- docs/operating/security.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/operating/security.md b/docs/operating/security.md index 37e21545a..845b4313b 100644 --- a/docs/operating/security.md +++ b/docs/operating/security.md @@ -211,8 +211,10 @@ may wish to block such paths to prevent CSRF. For non-mutating endpoints, you may wish to set [CORS headers](https://fetch.spec.whatwg.org/#http-cors-protocol) such as -`Access-Control-Allow-Origin` in your reverse proxy to prevent -[XSS](https://en.wikipedia.org/wiki/Cross-site_scripting). +`Access-Control-Allow-Origin` in your reverse proxy if a browser +application on another origin should be allowed to read those +responses. CORS relaxes the Same-Origin Policy; it is not a defence +against [XSS](https://en.wikipedia.org/wiki/Cross-site_scripting). If you are composing PromQL queries that include input from untrusted users (e.g. URL parameters to console templates, or something you built yourself) who