CORS Misconfiguration

CORS misconfiguration occurs when Access-Control-Allow-Origin is set too permissively, allowing unauthorized domains to make requests to your API.

Scan for This Vulnerability

What is CORS Misconfiguration?

Cross-Origin Resource Sharing (CORS) controls which domains can access your API. Misconfigured CORS (especially using wildcards with credentials) allows malicious websites to make authenticated requests on behalf of your users, stealing data or performing actions.

How It Happens

Using wildcard (*) for Access-Control-Allow-Origin
Reflecting the Origin header without validation
Allowing credentials with permissive origins
Not understanding CORS security implications

Impact

Data theft from authenticated APIs

Unauthorized actions performed via user sessions

Cross-site data leakage

API abuse from malicious sites

How to Detect

Check API responses for Access-Control-* headers
Test if arbitrary origins are reflected
Verify credentials aren't allowed with wildcards
Run VAS to detect CORS issues

How to Fix

Whitelist specific origins

Only allow known, trusted domains.

// Express.js example
const corsOptions = {
  origin: ['https://myapp.com', 'https://admin.myapp.com'],
  credentials: true
};

Never use wildcard with credentials

Browsers block this combination, but misconfigured servers may allow it.

// BAD
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true

// GOOD - specific origin
Access-Control-Allow-Origin: https://myapp.com
Access-Control-Allow-Credentials: true

Validate reflected origins

If dynamically setting origin, validate against allowlist.

const allowedOrigins = ['https://myapp.com'];
const origin = req.headers.origin;
if (allowedOrigins.includes(origin)) {
  res.setHeader('Access-Control-Allow-Origin', origin);
}

Commonly Affected Platforms

Vercel Security Netlify Security Railway Security Render Security Supabase Security

Is Your App Vulnerable?

VAS automatically scans for cors misconfiguration and provides detailed remediation guidance.

Run Security Scan

Related Vulnerabilities

Api Security Authentication Bypass