The allowlist that allows everyone
The API needs to be callable with cookies from several of the company's own front-ends, whose hostnames change often. So it echoes whatever origin made the request back in the response, and permits credentials.
Every rule is satisfied — the response never contains a wildcard, which is the thing everyone knows is forbidden alongside credentials. And any site on the internet can now make authenticated calls and read the replies.
Outside every boundary: API (cookies attached), Your front-end, Any other site (sends its own origin; FAILED: gets echoed back), an empty slot for the how the origin is decided Connections: Your front-end calls how the origin is decided (step 1) Any other site calls how the origin is decided (step 2) how the origin is decided calls API — known origins only (step 3)