Skip to content
Security Risks of Setting Access Control Allow Origin: *
projectblack.io | research | #web-security | #data-exfiltration | #cors | #http-headers | #same-site
Summary
When wildcard CORS turns dangerous: with cookie auth, SameSite=None, credentials enabled, and a reflected origin, malicious sites can read authenticated responses. Fixes include SameSite Lax/Strict.
- Published
- Collected