cross-origin resource sharing
cross-origin resource sharing
Misconfigured CORS turns the same-origin policy into a write-once permission to leak credentials. Reflected origins, null origin, wildcard pitfalls.
← all categories
CORS is the mechanism that lets a browser permit cross-origin requests with credentials. When the
server reflects an attacker-controlled Origin header into Access-Control-Allow-Origin while
also sending Access-Control-Allow-Credentials: true, any malicious site can read responses
intended for the victim.
The labs cover origin reflection, null origin abuse, wildcard subdomain trust, preflight bypasses,
and how CORS interacts with cookies, authorization headers, and proxies.
// labs
0 live · 0 total> no labs in this category yet, still cooking.