Skip to content

Security & Privacy

Secure Cross-Origin Resource Sharing (CORS) Policy

Description

Cross-Origin Resource Sharing (CORS) is a security feature enforced through HTTP headers that enables a web client to securely request resources from a server on a different domain. To maintain strict security standards, the application implements a secure CORS policy by allowing requests only from trusted origins. This is achieved by specifying a whitelist of approved domains, effectively mitigating the risk of unauthorized access and potential attacks.

Key Features of the CORS Implementation:

  1. Origin Control: CORS allows servers to specify which domains are permitted to access their resources using the Access-Control-Allow-Origin header. This prevents unauthorized cross-domain access.

  2. Preflight Requests: For certain HTTP methods or custom headers, browsers send a preflight OPTIONS request before the actual request. This checks if the server allows the intended method and headers with the Access-Control-Allow-Methods and Access-Control-Allow-Headers headers.

  3. Allowed HTTP Methods: The server can specify which HTTP methods (e.g., GET, POST, PUT, etc.) are permitted using the Access-Control-Allow-Methods header.

  4. Allowed Headers: Servers can declare which request headers can be used in the actual request with the Access-Control-Allow-Headers header.

  5. Credentials Support: CORS can handle credentials (cookies, HTTP authentication) by using the Access-Control-Allow-Credentials header, enabling servers to allow or block credentials in cross-origin requests.

  6. Caching of Preflight Responses: Servers can specify how long the results of a preflight request can be cached using the Access-Control-Max-Age header, reducing the number of preflight requests sent.

  7. Exposed Response Headers: The server can explicitly specify which response headers can be accessed by the browser using the Access-Control-Expose-Headers header.

This secure implementation of CORS ensures that users can interact with the application without exposing sensitive information to malicious actors.

Recommendation

The implementation is secure, no recommendations apply.

Detect this with Ostorlab

Ostorlab checks web applications, APIs and networks for this issue.

Create an account

Standards

  • OWASP_TOP_10:
    • A05_2021