CORS (Cross-Origin Resource Sharing)

Description

CORS (Cross-Origin Resource Sharing) vulnerability occurs when a web application improperly allows requests from unauthorized origins to access restricted resources. This can lead to unauthorized access or data exposure. Mitigation involves configuring proper CORS headers to restrict access only to trusted origins and implementing server-side validation of requests to prevent unauthorized access.

Remediation

Restrict the 'Access-Control-Allow-Origin' header to trusted origins or use a strict whitelist policy. Avoid using wildcards (e.g., '*') in production unless the application explicitly needs open cross-origin access. Validate CORS requests on the server side to ensure unauthorized domains are not granted access. Log and monitor cross-origin requests for suspicious patterns, and ensure HTTPS is enforced to protect data in transit. Regularly review CORS configurations, especially when adding new endpoints or modifying application domains, to confirm that no overly permissive rules have been introduced.

References

Severity

Owasp

Code: A05:2021

Category: Security Misconfiguration

Classification