domains / families / security / cors-cross-origin-misconfiguration

cors-cross-origin-misconfiguration

separate

CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.

When to use

• analyzing cross-origin trust
• credentialed browser reads
• origin reflection
• preflight policy bugs
• browser-based access to authenticated APIs
• wildcard trust
• parser mistakes
• origin allowlist bypasses

When not to use

• JSONP hijacking deep dives
• same-origin policy internals
• honeypot de-anonymization
• CORS vs JSONP comparison

Skill page

Source