CORS Security Misconfiguration — Common Mistakes That Expose Your API

In this tutorial, you will learn about CORS Security Misconfiguration. We cover key concepts, practical examples, and best practices to help you master this topic.

CORS security misconfigurations occur when CORS headers are set too permissively, allowing untrusted origins to access API responses, potentially leaking sensitive data or enabling cross-origin attacks.

What You'll Learn

• Dangerous CORS configurations to avoid
• How to audit CORS headers for security
• Best practices for production CORS

Why It Matters

A permissive CORS configuration is one of the most common API security vulnerabilities. It can allow any website to read authenticated API responses. DodaTech's security team runs automated CORS audits on all internal and partner APIs.

flowchart TD
    A["CORS Audit"] --> B{"Allow-Origin: * ?"}
    B -->|"Yes"| C{"With Credentials?"}
    C -->|"Yes"| D["CRITICAL: Any site can access"]
    C -->|"No"| E["WARNING: Public data exposure"]
    B -->|"No, specific origin"| F{"Validated against whitelist?"}
    F -->|"No, echo origin"| G["CRITICAL: Origin injection"]
    F -->|"Yes"| H["SAFE: Proper configuration"]
    style D fill:#fecaca,stroke:#dc2626
    style E fill:#fef08a,stroke:#ca8a04
    style G fill:#fecaca,stroke:#dc2626
    style H fill:#86efac,stroke:#16a34a

Code Examples

// VULNERABLE: Echoing any origin without validation
fetch('https://vulnerable-api.com/profile', {
  credentials: 'include'
});
// If API echoes Origin without whitelist check,
// any website can read authenticated responses

// SAFE: Specific origin
fetch('https://secure-api.com/profile', {
  credentials: 'include'
});
// API validates against whitelist

# VULNERABLE: Never do this
@app.after_request
def vulnerable_cors(response):
    # Echoes any origin without validation!
    response.headers['Access-Control-Allow-Origin'] = \
        request.headers.get('Origin', '*')
    response.headers['Access-Control-Allow-Credentials'] = 'true'
    return response

# SAFE: Always validate
@app.after_request
def secure_cors(response):
    origin = request.headers.get('Origin')
    if origin in WHITELIST:
        response.headers['Access-Control-Allow-Origin'] = origin
        response.headers['Access-Control-Allow-Credentials'] = 'true'
        response.headers['Vary'] = 'Origin'
    return response

// CORS security scanner function
function scanCorsSecurity(response) {
  const acao = response.headers.get('Access-Control-Allow-Origin');
  const acac = response.headers.get('Access-Control-Allow-Credentials');

  if (acao === '*' && acac === 'true') {
    console.error('CRITICAL: Wildcard + Credentials');
  }
  if (acao === '*') {
    console.warn('WARNING: Wildcard origin - no authentication');
  }
  if (!acao) {
    console.warn('WARNING: No CORS headers');
  }
  if (acao && acac) {
    console.log('OK: Credentials with specific origin');
  }
}

Common Mistakes

1. Echoing Origin Without Validation

Never set ACAO to the request Origin without checking it against a whitelist.

2. Using Wildcard with Authentication

Access-Control-Allow-Origin: * with authenticated endpoints is dangerous.

3. Allowing null Origin Too Broadly

The null origin can be set by sandboxed contexts. Only allow null if specifically needed.

4. Exposing Too Many Endpoints

Apply CORS only to endpoints that need cross-origin access. Internal APIs should use same-origin only.

5. Not Auditing CORS Configuration

CORS configs drift over time. Regular audits catch origins that should have been removed and misconfigurations.

Practice Questions

1. What is the most dangerous CORS Misconfiguration?
2. Why is echoing the Origin header dangerous?
3. What is the null origin risk?
4. How do you audit CORS headers?
5. What should you do if you find a CORS misconfiguration?

Answers:

1. Wildcard origin with credentials enabled.
2. Any website can set the Origin header and receive API responses with credentials.
3. The null origin can be set by sandboxed iframes, enabling embedded attacks.
4. Use curl or automated scanners to check CORS headers on all endpoints.
5. Immediately restrict the origin, remove credentials if origin must be wildcard, and rotate any exposed tokens.

Challenge: Perform a CORS security audit on a test API. Use curl and browser tools to identify all CORS headers, test for origin injection vulnerabilities, check for wildcard credentials conflicts, and generate a security report with findings and remediation steps.

FAQ

Mini Project

Build a CORS security auditor: a tool that takes an API base URL, crawls all endpoints, sends CORS test requests with various origins, and generates a detailed security report. Include a scoring system (A-F) and specific remediation steps for each finding.

What's Next

Explore CORS vulnerabilities and attack vectors, then learn about credential theft via CORS attacks.