Profile My skills Saved Collections Edit profile Submit a skill

CORS Private Network Access Misconfiguration

Detects CORS configurations that allow access from public origins to private network endpoints.

zakirkun Updated
Coding & Dev Tools

File contents

CORS Private Network Access Misconfiguration

Overview

Chrome's Private Network Access (PNA) restrictions protect internal services. However, misconfigured CORS headers (Access-Control-Allow-Private-Network: true without origin restriction) allow malicious public websites to make requests to internal APIs running on private IP ranges. This enables CSRF attacks against private services.

Remediation

  • Only allow specific trusted origins for private network access
  • Implement authentication on all internal APIs
  • Do not set Access-Control-Allow-Private-Network: true for wildcard origins

zakirkun/ice-tea/tree/main/skills/web/cors-private-network commit 3557ad7584

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/cors-private-network-access-misconfiguration