A wildcard in the allowed origins list lets browser code from any website call your function. Microsoft's Azure Functions guidance says to avoid wildcards and instead add a separate entry for each web app that needs access. CORS is a browser control that limits which sites may read responses, and a wildcard removes that limit.
What CORS is for
Cross-origin resource sharing lets a web app on one domain make requests to an HTTP endpoint on another. Without it, browsers block those cross-site calls by default. The rules are served as response headers, such as Access-Control-Allow-Origin.
In Azure Functions, CORS rules are defined at the function app level, through the portal or the CLI. When enabled, responses include the allow origin header. Microsoft's text describes the wildcard temptation directly: it is tempting to allow all sites, and that defeats the purpose of CORS.
What a wildcard actually exposes
Suppose your function returns data for the signed in user based on a cookie or a token the browser attaches. A hostile page that a visitor opens can make the visitor's browser call your endpoint. With a wildcard origin list, the browser lets that hostile page read the response. The hostile page does not need your credentials. It borrows the visitor's.
How much a wildcard exposes depends on how the endpoint authenticates and what browsers allow in that case, which the Azure page does not detail. Check the browser rules for credentialed requests before you rely on any workaround, and do not reflect the request origin back as a shortcut, since that recreates the wildcard.
What CORS does not do
- It does not stop non browser callers. A script or another server ignores CORS completely.
- It does not authenticate anyone.
- It does not replace validation on the server.
CORS limits which sites a visitor's browser will let read your responses. Treat it as one layer.
How to set it properly
- List each real origin: scheme, host and port, for example your production site and your staging site. Each one is its own entry.
- Keep staging and local development origins out of production configuration.
- Review the list when a site is retired or a domain changes hands.
- If an endpoint is meant for server to server calls only, do not enable CORS for it at all.
Audit steps
- Find every serverless HTTP endpoint with CORS enabled.
- Search the settings for a bare star or a reflected origin.
- Compare the allowed list with the sites that actually call the endpoint, using logs.
- Remove anything unused.
Quick check
Does a CORS allow list protect my function from curl?
No. CORS is enforced by browsers. A command line client or another server ignores it.
Where does Azure Functions apply CORS rules?
At the function app level, so they cover all HTTP triggered functions in the app.
Sources
Last reviewed: 19 October 2026.
