I am doing a verification test for a CORS issue that we discovered. When specifying an origin, the application used to respond with the allow origin to any URL. However, upon retest, the application now returns two Access-Control-Allow-Origin headers, one that we specified (in Origin) and their specific trusted one.
I've attempted a POC and it fails to load due to "The 'Access-Control-Allow-Origin' header contains multiple values, but only one is allowed.". Which is good, meaning they have fixed the issue! But, is this an acceptable fix they have provided?
This is the response headers, after specifying a the request header with
HTTP/1.1 200 OK Cache-Control: Private, max-age=0, no-cache Allow: GET Content-Type: application/json; charset=UTF-8 Vary: Origin X-Robots-Tag: noindex Link: <https://www.TARGET.com/>; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages Access-Control-Allow-Headers: Authorization, Content-Type Access-Control-Allow-Origin: http://test.com Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE Access-Control-Allow-Credentials: true Strict-Transport-Security: Max-age=7776000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: https://www.TARGET.com Date: Fri, 27 Jul 2018 11:25:56 GMT Connection: close Content-Length: 58654