Security Test: CORS¶

Description¶

Default Severity: low

CORS issues happen when a web server is set up to share resources with other websites in a way that's too open or not specific enough. This means that attackers might trick browsers into sending requests from an authenticated session to the wrong place, which could let them perform actions the user didn’t intend. The danger comes when these open policies let outsiders execute unauthorized commands or access sensitive data, so it’s important for developers to carefully restrict which sites can interact with their applications. A common mistake is using overly broad rules (like wildcards) instead of specifying trusted origins, which can inadvertently give attackers a way in.

Reference:

• https://portswigger.net/web-security/cors

Configuration¶

Identifier: protocol/cors

Examples¶

All configuration available:

checks:
  protocol/cors:
    skip: false # default

Compliance and Standards¶