Protocol: Missing Vary: Origin Header in CORS Response¶

Identifier: cors_vary_header

Scanner Support¶

Description¶

When a server dynamically sets Access-Control-Allow-Origin based on the request Origin header but omits Vary: Origin, shared caches and CDNs may store one origin-specific response and serve it to other origins. This can cause cache confusion and, in worst cases, cross-origin data exposure when CORS headers are involved.

How we test: We send cross-origin requests and inspect responses where Access-Control-Allow-Origin reflects the request Origin but Vary doesn't include Origin.

References:

• CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
• Fetch Standard: HTTP access control allow origin
• MDN: Vary header
• Portswigger: Cross-origin resource sharing (CORS)

Configuration¶

Example¶

Example configuration:

---
security_tests:
  cors_vary_header:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.