CORS Origin Reflection with Credentials Enabled

Description

CORS Origin Reflection with Credentials Enabled occurs when a server reflects the origin supplied in the HTTP Origin header in its Access-Control-Allow-Origin response header and also permits credentialed cross-origin requests, typically through Access-Control-Allow-Credentials: true. If an untrusted origin is accepted and the response contains sensitive information, a malicious website may be able to make cross-origin requests using a victim’s credentials and read the responses. The actual risk depends on the origin validation logic, the affected endpoints, the authentication mechanism, and the sensitivity of the accessible data.

Recommendation

Configure CORS to allow only explicitly trusted origins. Do not blindly reflect arbitrary Origin header values when enabling credentialed requests. Set Access-Control-Allow-Credentials: true only when cross-origin credential sharing is required, and ensure that every permitted origin is appropriately trusted. Avoid wildcard or overly broad origin matching, and verify that sensitive endpoints enforce authentication and authorization independently of CORS. Test whether an untrusted origin can make credentialed requests and read protected responses.

References

• OWASP CORS Cheat Sheet
• MDN: Cross-Origin Resource Sharing (CORS)
• CWE-16