HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 12
Connection: close
Date: Tue, 25 Sep 2018 12:59:56 GMT
x-amzn-RequestId: xxxxxxxxxxx
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type,Authorization,Accept,X-Amz-
Date,X-Api-Key,X-Amz-Security-Token,x-client-type,x-client-version,x-
anonymous-id
x-amz-apigw-id: xxxxxx
X-Amzn-Trace-Id: Root=xxxxxxxxx;Sampled=0
X-Cache: Miss from cloudfront
Via: 1.1 xxxxxxxxxxxxxx
X-Amz-Cf-Id: xxxxxxxxxxxxxx
{"ok": true}
I am getting confused that this response indicates CORS vulnerability.
When I send the request I have changed the Origin: evil.com
and then I get above response.
Can anyone tell me if this response indicates CORS vulnerability?