CORS
Cross-Origin Resource Sharing
The Fetch Standard protocol in which a server’s Access-Control-Allow-* response headers let pages from other origins read its responses, relaxing the same-origin policy. It never stops a request from being sent, and reflecting any Origin with credentials allowed lets other sites read authenticated data (CWE-942).
- Defined in
- WHATWG Fetch Standard: the CORS protocol
- Identifiers
- CWE-942: Permissive CORS policy
Covered in
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Prevent subdomain takeover from dangling DNS records
A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.
Protect cookie-authenticated actions against CSRF
Make the server distinguish an intended action from a request another site caused the browser to send.
Practice: CSRF lab: Protect an account change from a forged request · CORS policy lab: Grant CORS to the right origins only · CSP builder lab: Build a strict Content-Security-Policy