18

Recently PortSwigger (guys behind Burp Suite) came up with a blog post discussing the security risks associated with CORS mis-configurations.

http://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html

In summary, the blog talks about insecure ways of enabling CORS which can allow malicious web sites to read data from a target site. Towards the end, the blog talks about a prevention mechanism involving the Vary: Origin header:

If you take a look at the 'Implementation Considerations' section in the CORS specification, you'll notice that it instructs developers specify the 'Vary: Origin' HTTP header whenever Access-Control-Allow-Origin headers are dynamically generated.

I am having a hard time understand how exactly the Vary header helps prevent CORS exploitation (XSS using cache poisoning) in a scenario where the Access-Control-Allow-Origin header is dynamically generated (controlled by client).

Improve this question

2 Answers 2

Reset to default
15

It's important to include the Vary: Origin header to prevent caching. The header indicates that the response is in some way dependent on the origin and should therefore not be served from cache for any other origin. If the header is missing, cache poisoning attacks might be possible as explained in the article by the example of XSS via a reflected custom header. A missing Vary header doesn't create a vulnerability on its own.

Improve this answer
5
  • 1
    So this control would only prevent the cache poisoning attacks. There would still be risk associated with accepting arbitrary origins for cross domain data access. Is my understanding correct?
    – Shurmajee
    Commented Feb 23, 2017 at 7:58
  • @Shurmajee Yes!
    – Arminius
    Commented Feb 23, 2017 at 14:28
  • "should therefore not be served from cache for any other origin" - does it mean that if my frontend app runs on a different domain, and the browser makes requests to this endpoint on the frontend app's behalf, the responses would not get cached? even if Cache-Control headers are set correctly?
    – gaurav5430
    Commented Jun 22, 2019 at 17:35
  • 1
    @Arminius Would this attack not be mitigated by the proper cache-control directives?
    – Rice
    Commented Jul 19, 2019 at 16:08
  • This response isn't quite correct. Vary: Origin does not instruct caches not to cache responses. Rather, it instructs caches to make the request's Origin header (if any) part of the cache key. If the cache respects the Vary header (some, like Cloudflare do not), the cache will cache responses; it will simply add a new entry for the response to a request with an Origin header that the cache hasn't seen before (or has since forgotten).
    – jub0bs
    Commented Nov 13, 2022 at 22:00
2

In the context of CORS requests, the “Vary: Origin” header is particularly important. When a browser makes a CORS request, it automatically adds an “Origin” header to indicate the source of the request. The server must check this header and add an “Access-Control-Allow-Origin” header to indicate which sources can access the requested resource.

If the “Access-Control-Allow-Origin” header is missing from the response, the browser will reject the response and throw a CORS error. This is because the browser enforces the same-origin policy to prevent malicious websites from accessing data from other websites.

If the server adds the “Access-Control-Allow-Origin” header but does not correctly configure “Vary: Origin”, cache confusion and CORS errors may occur. This is because the browser checks the “Vary” header before caching a response to ensure that the cached response only applies to the same request headers. If “Vary: Origin” is not set, the browser may incorrectly apply the cached response to different “Origin” request headers, leading to CORS errors.

Understanding the Importance of “Vary: Origin” to Prevent Cache Confusion and CORS Errors: https://medium.com/p/ef3b63046b00

Improve this answer
2
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – mentallurg
    Commented Mar 7, 2023 at 17:43
  • @mentallurg makes sense!
    – Raymond Peng
    Commented Mar 8, 2023 at 18:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .