zakirkun CORS Misconfiguration
Overview
CORS misconfigurations allow attackers to make cross-origin requests that read sensitive API responses from a victim's browser. Common issues:
- Wildcard with credentials:
Access-Control-Allow-Origin: *combined with credentials is rejected by browsers but misconfiguring the origin reflection is not - Reflected origin: Origin header value reflected directly without validation
- Null origin: Allowing
nullorigin (sandbox iframes) - Subdomain wildcard: Allowing
*.example.comwhich includes attacker-controlled subdomains
Remediation
- Maintain an explicit allowlist of trusted origins
- Never reflect the
Originheader directly without validation - Never allow
nullorigin in production - Do not combine
Access-Control-Allow-Credentials: truewith broad origin policies