Vulnerability field guide

CORS Misconfiguration

An overly permissive CORS policy lets a malicious site read responses meant only for the victim. Here is how reflecting the Origin header goes wrong, and how a strict allowlist fixes it.

1 article 3 min total Overview to advanced techniques

Client-side & redirectsOverview Origin: https://evil.example

Start with the overview

CORS Misconfiguration3 min read

CORS Misconfiguration: When a Stranger's Website Can Read Your Logged-In Data

An overly permissive CORS policy lets a malicious site read responses meant only for the victim. Here is how reflecting the Origin header goes wrong, and how a strict allowlist fixes it.

Read the overview