Protocol: Missing Access-Control-Allow-Origin Header¶

Identifier: cors_acao_missing

Scanner(s) Support¶

Description¶

When a browser makes a cross-origin request, it sends an Origin header and expects a matching Access-Control-Allow-Origin response header to read the response. A missing ACAO causes browsers to block cross-origin reads. Depending on context—especially when Access-Control-Allow-Credentials: true is present without ACAO—this may indicate a broken or inconsistent CORS configuration.

How we test: We send requests with an Origin header and flag responses that omit Access-Control-Allow-Origin, including cases where credentials-related CORS headers are present.

References:

• CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
• OWASP WSTG — Testing Cross Origin Resource Sharing
• MDN — Access-Control-Allow-Origin

Configuration¶

Example¶

Example configuration:

---
security_tests:
  cors_acao_missing:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.