I am doing a verification test for a CORS issue that we discovered. When specifying an origin, the application used to respond with the allow origin to any URL. However, upon retest, the application now returns two Access-Control-Allow-Origin headers, one that we specified (in Origin) and their specific trusted one.

I've attempted a POC and it fails to load due to "The 'Access-Control-Allow-Origin' header contains multiple values, but only one is allowed.". Which is good, meaning they have fixed the issue! But, is this an acceptable fix they have provided?

This is the response headers, after specifying a the request header with Origin: http://test.com

HTTP/1.1 200 OK
Cache-Control: Private, max-age=0, no-cache
Allow: GET
Content-Type: application/json; charset=UTF-8
Vary: Origin
X-Robots-Tag: noindex
Link: <https://www.TARGET.com/>; rel="https://api.w.org/"
X-Content-Type-Options: nosniff
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Allow-Origin: http://test.com
Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Credentials: true
Strict-Transport-Security: Max-age=7776000
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Origin: https://www.TARGET.com
Date: Fri, 27 Jul 2018 11:25:56 GMT
Connection: close
Content-Length: 58654
  • relying on a certain behavior upon error isn't a good security strategy; send only the header you need – dandavis Jul 27 '18 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.