Security Test: Access-Control-Allow-Origin Header¶

Scanner(s) Support¶

Description¶

Default Severity: low

The Access-Control-Allow-Origin header tells the browser which websites are allowed to access resources on your server. When developers set it too loosely—by using a wildcard (*) or forgetting it altogether—it can allow any site to make requests. This misconfiguration can let attackers access sensitive data or misuse authenticated sessions, increasing the risk of data leaks or unauthorized actions. The biggest pitfall is treating cross-origin resource sharing as an afterthought instead of a security concern, which opens up your application to potential exploitation.

Reference:

• https://owasp.org/www-community/Security_Headers
  • https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes.html

Configuration¶

Identifier: protocol/header_access_control_allow_origin

Examples¶

All configuration available:

checks:
  protocol/header_access_control_allow_origin:
    skip: false # default

Compliance and Standards¶