cors
2 posts
Article
CORS misconfiguration is consent, not an exploit
CORS misconfiguration explained at the mechanism level: origin reflection, null origin, broken allowlist matching, the credentialed-read exploit path, and why it stays invisible in telemetry.
Article
The same-origin policy is not protecting your API
A permissive CORS header delegates the read decision to the requester, letting attacker script read authenticated responses through the victim's own browser.