While testing a website for CORS misconfiguration, I have found that access-control-allow-origin header is being set dynamically based on host header in requests.

Is it safe or can be exploited? Origin header is not getting validated.

allow-credential header is set to true


1 Answer 1


If Access-Control-Allow-Origin contains the originating domain, and Access-Control-Allow-Credential is true, any webpage on the internet can perform an authenticated request and read the results. Any page or information you can see after logging in is also accessible by other web pages. So this seems pretty insecure.

This only works when the vulnerable web page uses cookies (or basic auth) for authentication. If it requires an authentication header it won't work, since that is not included by the browser in a cross-site request.

One way to really know if it's vulnerable is to try it: start a webserver on your computer and try to fetch an authenticated web page using JavaScript.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .