PTKDMobile App Security
Knowledge base / PTKD-API-CORS-WILDCARD
medium M3 MASVS-NETWORK-1 dynamic analysis PTKD-API-CORS-WILDCARD

Permissive CORS with credentials

An endpoint returned Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true (or reflected an arbitrary Origin), which lets any website read authenticated responses.

How it's exploited

An endpoint returns Access-Control-Allow-Origin: * (or reflects the request Origin) together with Access-Control-Allow-Credentials: true. Any malicious website the user visits can then make credentialed cross-origin requests to your API and read the authenticated responses.

Why it matters

Cross-site data theft: another site reads the victim's private API responses using their session.

How to fix it

  1. Never combine a wildcard or reflected origin with credentialed CORS.
  2. Allow-list the exact origins that need cross-origin access, and avoid credentials on cross-origin APIs entirely where possible.

References