icon: material/server title: Missing Vary: Origin Header in CORS Response search: exclude: true

Do not modify directly the Markdown file. This file is autogenerated from security-test-page-next.md.jinja¶

Protocol: Missing Vary: Origin Header in CORS Response¶

Identifier: cors_vary_header

Scanner(s) Support¶

Description¶

When a server dynamically sets Access-Control-Allow-Origin based on the request Origin header but omits Vary: Origin, shared caches and CDNs may store one origin-specific response and serve it to other origins. This can cause cache confusion and, in worst cases, cross-origin data exposure when CORS headers are involved.

How we test: We send cross-origin requests and inspect responses where Access-Control-Allow-Origin reflects the request Origin but Vary does not include Origin.

References:

• CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
• Fetch Standard — HTTP access control allow origin
• MDN — Vary header
• Portswigger — Cross-origin resource sharing (CORS)

Configuration¶

Example¶

Example configuration:

---
security_tests:
  cors_vary_header:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.