CORS Misconfiguration Checker

What is CORS Misconfiguration Checker?

Cross-Origin Resource Sharing (CORS) is the browser mechanism that decides which other websites are allowed to read your API's responses. By default browsers block cross-site reads; CORS headers are how your server says "these specific origins are allowed." A misconfiguration is when those headers are too generous — trusting origins they shouldn't — which quietly hands other websites permission to read data meant only for your own site.

What Nandix checks

• Reflection of an arbitrary attacker Origin in Access-Control-Allow-Origin
• Wildcard origin (*) paired with Access-Control-Allow-Credentials: true
• Acceptance of the forgeable null origin
• Suffix/subdomain spoofing that defeats a naive substring allowlist
• Unrestricted wildcard origin on non-public data

Probes

5 checks

How it detects

Passive, response-only. It sends five Origin headers — three attack origins (arbitrary attacker, null, and a suffix-spoof of your host) plus same-origin and no-Origin controls — then inspects the returned Access-Control-Allow-Origin / Access-Control-Allow-Credentials to see whether an untrusted origin is reflected or credentialed. Only header behaviour is read; no request body is exercised.

Why it's dangerous

A permissive CORS policy lets an attacker's website make requests to your API using your logged-in user's session and read the results. If your API reflects any Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true, then any site a victim visits can pull their private data from your API — profile info, messages, tokens. It's a data-theft channel that needs no phishing and no password; the victim just has to be logged in and visit the wrong page.

Example finding

The API echoes any request Origin into Access-Control-Allow-Origin while sending Allow-Credentials: true — any website can read a logged-in user's data.

How to fix it

Treat the allowed-origins list as a strict allowlist, never a reflection. Never reflect the request Origin back unchecked — compare it against an explicit allowlist and only echo it if it matches. Never pair Allow-Origin: * with Allow-Credentials: true — browsers forbid it, but some servers send it anyway, which is a red flag for a broken policy. Reject the null origin — it's forgeable. Match origins exactly, not by startsWith/endsWith — evil-yoursite.com and yoursite.com.evil.com must not pass.

js

const ALLOWED = new Set([
  'https://app.yoursite.com',
  'https://yoursite.com',
]);

function corsOrigin(reqOrigin) {
  // exact match only — never reflect unchecked, never use includes()
  return ALLOWED.has(reqOrigin) ? reqOrigin : null;
}

Severities & standards

Severities

CRITICAL · HIGH · MEDIUM

References

• OWASP A05:2021 — Security Misconfiguration
• OWASP HTML5 Security Cheat Sheet — CORS

Frequently asked questions