WebOTG-BAC-004 — Cross-Origin Resource Sharing (CORS) Security Review

1. Executive Summary & Scope

Cross-Origin Resource Sharing (CORS) policies define how browsers access resources across distinct domain origins. Permissive configurations that dynamically reflect the incoming `Origin` header while setting `Access-Control-Allow-Credentials: true` enable malicious websites to read sensitive authenticated responses.

Standard Classification

OWASP Standard: OWASP Top 10 • Mapping: CWE-942 • Target Architecture: Public Web Systems & APIs

2. Threat Model & Attack Vectors

A victim visits an attacker-controlled site while logged into the target platform. Malicious JavaScript fetches authenticated user profile and financial data via cross-origin requests, exfiltrating the data to the attacker server.

3. Code Analysis & Remediation Playbook

Vulnerable Implementation Pattern

// VULNERABLE: Blindly reflecting Origin and allowing credentials $origin = $_SERVER['HTTP_ORIGIN'] ?? '*'; header("Access-Control-Allow-Origin: $origin"); header("Access-Control-Allow-Credentials: true");

Hardened Defense-in-Depth Implementation

// REMEDIATED: Strict origin whitelist validation $allowedOrigins = [ 'https://webotg.com', 'https://app.webotg.com', 'https://auth.webotg.com' ]; $origin = $_SERVER['HTTP_ORIGIN'] ?? ''; if (in_array($origin, $allowedOrigins, true)) { header("Access-Control-Allow-Origin: $origin"); header("Access-Control-Allow-Credentials: true"); header("Vary: Origin"); } else { // Non-whitelisted origin: do NOT reflect and do NOT allow credentials header("Access-Control-Allow-Origin: https://webotg.com"); }

4. Audit Verification Checklist & Pass Criteria

Verification Phase	Audit Test Description	Mandatory Passing Criteria
Null Origin Testing	Send request with header `Origin: null`.	Server must NOT return `Access-Control-Allow-Origin: null` with credentials allowed.
Regex Bypass Probing	Send origins with prefixes/suffixes: `webotg.com.attacker.com` or `attackerwebotg.com`.	Origin rejected unless strictly matching whitelisted domain regex anchors.
Preflight OPTIONS Verification	Send preflight OPTIONS request containing custom headers.	Preflight response specifies explicit permitted headers and finite max-age cache duration.

WebOTG Application Security Directorate

Senior Security Auditor

WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.