I'm trying to verify the CORS settings of a website using cURL. The following command should let me check whether the CORS settings can be considered as secure or if requests may be made across origins.
I'm performing a preflight check, but the same should work with normal request and the origin header.
curl -H "Origin: https://example.local" \ -H "Access-Control-Request-Method: POST" \ -H "Access-Control-Request-Headers: X-Requested-With" \ -X OPTIONS -D - -o /dev/null\ -x http://127.0.0.1:8080/\ https://example.com
GET with Origin:
curl -H "Origin: https://example.local"\ -D - -o /dev/null\ https://example.com
Now what I do not understand, is that the target application simply answers with the content as usual. No
So I effectively can't decide on whether the CORS settings are secure or not. I tried to proxy the requests through Burp (with the two methods below), but something's wrong there and the request never reaches Burp.
Method 1 cURL:
curl [...] -x http://127.0.0.1:8080/ [...]
Method 2 CLI:
export https_proxy='https://127.0.0.1:8080/' export http_proxy='http://127.0.0.1:8080/' curl [...] export https_proxy='' export http_proxy=''
What may cause the odd behavior of the web application with my OPTIONS pre-flight requests and the GET request with the origin header. How can I successfully proxy the request through Burp to verify the request itself?