Vulnerability field guide
CORS Misconfiguration
An overly permissive CORS policy lets a malicious site read responses meant only for the victim. Here is how reflecting the Origin header goes wrong, and how a strict allowlist fixes it.
1 articles3 min totalOverview to advanced techniques
Start here
Origin: https://evil.exampleStep 01 · Start with the overview
CORS Misconfiguration3 min read
CORS Misconfiguration: When a Stranger's Website Can Read Your Logged-In Data
An overly permissive CORS policy lets a malicious site read responses meant only for the victim. Here is how reflecting the Origin header goes wrong, and how a strict allowlist fixes it.
Read the overview