Senior LevelREST APIs & Web Services
How do origin reflection vulnerabilities compromise CORS security and how do you prevent them?
❓ Interview Prompt: Explain CORS Origin Reflection vulnerabilities (`Access-Control-Allow-Origin: req.headers.origin`), regex validation flaws, and safe origin lookup maps.
The Origin Reflection Vulnerability:
Lazy developers often write CORS middleware that blindly reads 'req.headers.origin' and echoes it back in 'Access-Control-Allow-Origin: req.headers.origin' with 'Access-Control-Allow-Credentials: true'!
•
Exploit: An attacker opens 'http://evil.com' which makes authenticated API requests, and the server blindly grants access to 'evil.com'!
Defense:
Never dynamically reflect request origins without validating against an immutable 'Set' lookup of whitelisted domains.
Code Implementation Example
typescript
const WHITELISTED_DOMAINS = new Set([
'https://example.com',
'https://app.example.com'
]);
export function validateCorsOrigin(origin: string | undefined): boolean {
if (!origin) return false;
// Strict exact Set lookup (Avoid regex startsWith bugs!)
return WHITELISTED_DOMAINS.has(origin);
}💡Strict whitelisted origin validation preventing CORS origin reflection exploits.
🎯 Interview Key Takeaway
Never echo req.headers.origin blindly into CORS response headers; validate origins using strict Set lookup whitelists.
#CORS#Security Vulnerability#Origin Reflection#Senior
Back to all REST APIs & Web Services Questions→