Origin Reflection

Description

Origin Reflection occurs when a server includes the value supplied in the HTTP Origin header in its response. This behavior may indicate that the application dynamically processes origin values and could warrant further investigation of its Cross-Origin Resource Sharing (CORS) configuration. Reflection alone does not necessarily constitute a vulnerability; the risk depends on whether the reflected value is used in security-sensitive response headers or enables unauthorized cross-origin access.

Recommendation

Review how the application handles the Origin header and ensure that origin values are not blindly reflected in security-sensitive response headers. If Cross-Origin Resource Sharing is required, validate the requesting origin against an explicit allowlist of trusted origins, including the scheme, hostname, and port where applicable. Reject untrusted origins and avoid relying on substring matching or other weak validation techniques. Verify that the CORS configuration does not grant unintended access to sensitive resources.

References

• OWASP CORS Cheat Sheet
• MDN: Cross-Origin Resource Sharing (CORS)
• CWE-16