I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to feeds.

What are the dangers (if any) I'm creating if I do this?

add_action( 'pre_get_posts', 'add_header_origin' );

function add_header_origin() {
    if (is_feed()){
        header( 'Access-Control-Allow-Origin: *' );

You need to have a super great reason to disable CORS, as no real reason was given here the answer should be "do not do it, it is not secure".

You assume that no one can craft a feed link which will give him a write access. This might be true, but you should not open holes in your security based on "assuming".

In the very least, if some other domain needs "AJAX" access to your feeds, you should disable CORS only for that specific domain.

In addition pre_get_posts is totally the wrong place to do it, and you should do it on init. The way your code is currently written it may disable CORS for pages which are not feed.


I read this post as saying that as long as I'm not requiring login credentials (I'm not) that all is well.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.