Cross-Origin Resource Sharing (CORS) Misconfiguration

Medium Severity Technical Guide

Vulnerability Description

CORS is a browser security mechanism that restricts resources on a web page from being requested from another domain. A weak CORS configuration (such as reflecting the Origin header blindly or enabling wildcards with credentials enabled) allows malicious websites to read sensitive data from your web application on behalf of authenticated users.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Avoid wildcard "*" origins if credentials (cookies/tokens) are supported. Whitelist specific, trusted origins and only return Access-Control-Allow-Credentials: true when necessary: Access-Control-Allow-Origin: https://trustedapp.com Access-Control-Allow-Credentials: true

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.