I'm testing an API, which allows an arbitrary origin on
GET requests, by responding with the CORS header
OPTIONS requests and an arbitrary origin, the web service does not respond with
Access-Control-Allow-Origin: *, it does not use the response header at all.
This means that any CORS preflight requests with an arbitrary Origin, would fail.
I don't see the point in having the CORS response header for
POST requests, but not the
OPTIONS request. However, I also can't provide an example for a vulnerability or how this may be exploited.
Q: Is it safe to say that does not pose a vulnerability, but is just bad practice?