thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Cross-Origin Resource Sharing (CORS)

A browser mechanism using HTTP headers that lets a server allow specific other origins to read its responses.

Definition

Servers return Access-Control-Allow-Origin and related headers; preflight OPTIONS requests check non-simple methods and headers. Misconfigurations include reflecting any Origin, allowing null, or combining permissive origins with Access-Control-Allow-Credentials: true. Allowlist exact trusted origins.

Example

Access-Control-Allow-Origin: https://app.example.com with Access-Control-Allow-Credentials: true

Exam tip

Reflecting arbitrary Origin with credentials allowed is a broken access control finding.

Related terms