Web SecurityMediumCross-Origin Resource Sharing flaws

CORS Misconfiguration

Over-permissive CORS lets malicious origins read authenticated responses from your API.

Overview

Reflecting the Origin header with Access-Control-Allow-Credentials:true, allowing null origin, or sloppy domain matching lets attacker pages perform credentialed cross-origin reads.

How it works

Reflecting the Origin header with Access-Control-Allow-Credentials:true, allowing null origin, or sloppy domain matching lets attacker pages perform credentialed cross-origin reads.

Example

http

Origin: https://evil.tld
Access-Control-Allow-Origin: https://evil.tld
Access-Control-Allow-Credentials: true

Impact

Theft of authenticated data, CSRF-token leakage, and account compromise.

Detection

Send varied Origin values (including null and subdomain tricks) and inspect the ACAO/ACAC response.

Prevention

Allowlist explicit origins; never reflect arbitrary Origin with credentials.
Avoid Access-Control-Allow-Origin: * for credentialed endpoints.
Reject the null origin and validate full origin, not substrings.