Protocol: Overly Permissive Access-Control-Allow-Origin Header¶

Identifier: cors_acao_misconfig

Scanner Support¶

Description¶

Overly permissive Access-Control-Allow-Origin values:such as *, reflected arbitrary origins, or null:can allow unauthorized websites to read responses in cross-origin contexts. When combined with Access-Control-Allow-Credentials: true, misconfigurations may expose authenticated user data or enable privileged actions from malicious origins.

How we test: We analyze CORS response headers for dangerous patterns including wildcard origins, null origin acceptance, and incompatible combinations of Access-Control-Allow-Origin and Access-Control-Allow-Credentials.

References:

• CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
• OWASP WSTG: Testing Cross Origin Resource Sharing
• Portswigger: Cross-origin resource sharing (CORS)

Configuration¶

Example¶

Example configuration:

---
security_tests:
  cors_acao_misconfig:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.