# Fix: POST response carries Access-Control-Allow-Origin

> Web-audit fix skill for the `mcp-cors-actual` check (MCP, SHOULD).

## Goal

Mirror the declared CORS posture on the actual MCP POST response.

## Fix

Echo `Access-Control-Allow-Origin` on the actual `POST` response whenever the preflight
declares CORS: a browser blocks the response body when the header is absent even though the
preflight passed. Omitting the header from both the preflight and the `POST` is a consistent
no-CORS posture and scores `n_a` with no penalty; this check fails when the preflight
declares CORS but the `POST` omits the header.

## Resources

- [MDN CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Mirror the declared CORS posture on the actual MCP POST response
Fix: Echo `Access-Control-Allow-Origin` on the actual `POST` response whenever the preflight declares CORS: a browser blocks the response body when the header is absent even though the preflight passed. Omitting the header from both the preflight and the `POST` is a consistent no-CORS posture and scores `n_a` with no penalty; this check fails when the preflight declares CORS but the `POST` omits the header.
Skill: https://anc.dev/fix/mcp-cors-actual
Docs: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `mcp-cors-actual` check should report `pass`.