Intermediate LevelWeb Security & Cyber Defense
How do attackers exploit dynamic origin reflection in CORS misconfigurations?
❓ Interview Prompt: Explain CORS misconfigurations, dynamic Origin header reflection (`Access-Control-Allow-Origin: req.headers.origin`), regex validation bugs, and null origin exploits.
Lazy CORS implementations create critical security holes by dynamically reflecting incoming 'Origin' headers:
Vulnerable Pattern:
'res.setHeader('Access-Control-Allow-Origin', req.headers.origin)' + 'Access-Control-Allow-Credentials: true'.
•
Exploit: Attacker visits 'http://evil.com' which calls the API. The server blindly reflects 'evil.com' as an allowed origin with credentials enabled, allowing attackers to steal user data!
•
Regex Bug: Using regex 'example.com' matches 'example.com.evil.com' or 'notexample.com'!
Code Implementation Example
typescript
const ALLOWED_ORIGINS = new Set(['https://example.com', 'https://app.example.com']);
export function safeCorsMiddleware(req: Request, res: Response, next: NextFunction) {
const origin = req.headers.origin;
if (origin && ALLOWED_ORIGINS.has(origin)) {
res.setHeader('Access-Control-Allow-Origin', origin);
res.setHeader('Access-Control-Allow-Credentials', 'true');
}
next();
}💡Enforcing strict Set lookup whitelisting for CORS origin reflection.
🎯 Interview Key Takeaway
Never reflect req.headers.origin dynamically without checking against an exact immutable whitelist Set.
#CORS Misconfiguration#Origin Reflection#Security#Intermediate
Back to all Web Security & Cyber Defense Questions→