I have done some research but have not found an absolute answer to my specific question. I understand the basic concept of how this header will allow or disallow website A from sending request and viewing response to resources on website B.

However, suppose website B set the header Access-Control-Allow-Credentials to false, and Access-Control-Allow-Origin: *, can this cause any concrete security risk to the user who is browsing website A (suppose website A is malicious)?

  • If website B uses authentication that ACAC doesn't understand, such as source IP address, that's vulnerable - but this will be rare. Security advice generally implies ACAO is dangerous, but I can't think of a concrete example of a weakness, and I reckon probably no impact. Interesting question, thanks – paj28 Mar 26 at 2:34
  • @paj28, I've seen the example following the link in the link you've provided, and yes I think the scenario is very specific, and the decision to solely based on IP for access-control is not safe by itself. – SamTest Mar 26 at 3:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.