CORS Writeup

Introduction

Cross-Origin Resource Sharing (CORS) is a browser security mechanism that controls how web applications share resources across different origins. While CORS is designed to relax the Same-Origin Policy safely, misconfigurations are extremely common and can lead to serious security issues, including account takeover, sensitive data exposure, and unauthorized actions.

In this write-up, we’ll walk through:

• How CORS works
• Common misconfigurations
• A real-world style vulnerability scenario
• Impact and remediation

This article is written for educational and defensive security purposes only.

What Is CORS?

By default, browsers block JavaScript from reading responses from another origin.

Example:

https://evil.com → https://target.com

CORS allows servers to explicitly say:

“It’s okay for this origin to read my responses.”

This is done using HTTP response headers like:

Get Youssefelbakrey’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Credentials: true

How CORS Is Supposed to Work

A secure CORS configuration usually follows these rules:

• Allow only trusted origins
• Avoid using wildcards with credentials
• Validate the Origin header strictly
• Never reflect arbitrary origins

Correct example:

Access-Control-Allow-Origin: https://trusted-site.com
Access-Control-Allow-Credentials: true

Common CORS Misconfigurations

Here are the most dangerous mistakes seen in real-world applications:

1. Reflecting the Origin Header :

Access-Control-Allow-Origin: https://attacker.com
Access-Control-Allow-Credentials: true

2. Wildcard with Credentials

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

3. Weak Origin Validation

Examples:

• Allowing *.trusted.com
• Allowing origins that contain trusted strings
• Regex-based checks without proper anchoring

in this private program i found

for POC

<script>
fetch("https://target.com/api/v1/user/profile", {
  credentials: "include"
})
.then(res => res.text())
.then(data => {
  console.log("Leaked data:", data);
});
</script>