About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal was to get the CSRF token from the webpage, which was displayed for logged in users. So the HTTP request performed by the POC actually sent user's cookies.
The scenario was like this one:
- User is logged on a.com
- User loads POC from attack.com
- The POC sends an HTTP request with user's cookies to a.com
- The POC retrieves the CSRF token and perform actions on a.com
I'm pretty sure the POC sent user's cookies, that I did not use the withCredentials attribute, and the header Access-Control-Allow-Credentials was not present in the targeted website. I used Firefox at this time.
Nowadays, the header Access-Control-Allow-Credentials: true is required in order to allow the response to be available plus the Access-Control-Allow-Origin header should not be set to * if cookies are sent.
So my question is, since when this restriction was added ?