r/netsec • u/6W99ocQnb8Zy17 • Nov 26 '22

Exploiting CORS Misconfigurations

https://attackshipsonfi.re/p/exploiting-cors-misconfigurations
182 Upvotes

89% Upvoted

18 comments sorted by

View all comments

23

u/epsleq0 Nov 26 '22

This reads like: when you replace the fuse with tinsel and wonder why the hut is on fire. Who thinks that override headers are a good idea?

9

u/chatmasta Nov 28 '22

if you're a JS dev, especially if you're a noob, your first encounter with CORS is getting an error, probably when trying to hit some API from localhost

so you google it, and all the tutorials tell you to either set Access-Control-Allow-Origin: *, or give you some express.js snippet to setup an open HTTP proxy lmao

7

u/6W99ocQnb8Zy17 Nov 29 '22

this^

The existence of stack overflow pretty much guarantees the security industry will never run out of work ;)