thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

CORS Misconfiguration

An overly permissive CORS policy that lets untrusted origins read authenticated responses.

Definition

Common errors are reflecting the request Origin header, trusting the null origin, using weak regex matching of subdomains and allowing credentials with broad origins. The fix is a strict allowlist of origins validated exactly on the server.

Example

An API echoes any Origin and sets Allow-Credentials true, so a malicious site can read a logged-in user's data.

Exam tip

Wildcard * cannot be used with credentials; reflection is the real danger.

Related terms