domains / families / security / testing-cors-misconfiguration

testing-cors-misconfiguration

separate

Identifying and exploiting Cross-Origin Resource Sharing misconfigurations

When to use

• During authorized penetration tests when assessing API endpoints for cross-origin access controls
• When testing single-page applications that make cross-origin API requests
• For evaluating whether sensitive data can be exfiltrated from a victim's browser session
• When assessing microservice architectures with multiple domains sharing data
• During security audits of applications using CORS headers for cross-domain communication

Skill page

Source