CORS Seguridad Referencia
Seguridad-focused referencia para CORS misconfigurations, credential handling, y attack vectors.
Common Misconfigurations
Reflecting the Origin header verbatim in Access-Control-Allow-Origin with credentials enabled is a critical vulnerability. Using Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true is rejected by browsers but some servers misconfigure. Allowing null origin (from sandboxed iframes or data: URLs) enables attacks. Overly broad origin allowlists (e.g., regex matching too broadly) create exposure. Internal APIs accessible via CORS from external origins break network segmentation.
- origin reflection
- Critical vuln
- null origin
- Sandbox/iframe
- broad regex
- Over-matching
with credentialsshould rejectallowlist too wideSecure Configuration
Maintain an explicit allowlist of trusted origins; check and reflect only those. Never combine wildcard origin with credentials. Strip credentials (cookies, auth headers) for untrusted origins. Validate origin against an exact-match allowlist, not substring or regex. Log CORS rejections for monitoring. Consider same-site vs same-origin carefully for cookie-based auth. Use Vary: Origin to prevent cache poisoning when reflecting origins.
- allowlist
- Exact match only
- Vary: Origin
- Prevent cache poisoning
- log
- Monitor rejections
no regexcaching headerdetect attacks