logo

CORS Header

  • Risk:

  • Informational

  • Type:
  • Active
Summary

Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that allows a server to indicate any other origins (domain, scheme, or port) than its own from which a browser should permit loading of resources. It relaxes the Same-Origin Policy (SOP).

Solution

If a web resource contains sensitive information, the origin should be properly specified in the Access-Control-Allow-Origin header. Only trusted websites needing this resource should be specified in this header, with the most secured protocol supported.

References

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

https://portswigger.net/web-security/cors

Free security scan for your website