Cross-Origin Resource Sharing implemented with universal access

Cross-Origin Resource Sharing (CORS) is a mechanism that uses additional HyperText Transfer Protocol (HTTP) header. This header will let the browser know that an application is running from one domain (Origin) and has permission to access resources from another origin (Server). This application is using Cross-Origin Resource Sharing in an insecure way. If this header is not properly configured, any website can send requests and read content using a CORS file or an origin header that returns the header without doing any additional checks.

Impact

The major impact includes code injection attacks. Code injection is the exploitation of a computer bug which includes processing invalid data.

Mitigation / Precaution

Beagle recommends the following:-

• Allow only selected, trusted domains in the Access Control Allow Origin header. The server uses access control allow origin header to inform which domains are authorized for the request.

Written by

Prathap

Co-founder, Director

Prathap has around 20 years of experience and has worked on various projects in leading companies like Hitachi, Toshiba, Schneider Electric, ABB, Panasonic, and MicroFuzzy. His expertise lies in architecting, designing, and developing secure projects covering various aspects of software development, processes, and methodology.