CORS

CORS decides which other sites may read answers from your server.

What it is

The server answers with Access-Control-Allow-Origin and, for logged in visitors, Access-Control-Allow-Credentials: true. Two patterns are dangerous: repeating back whatever origin asks, and allowing the origin null together with credentials.

Why it matters

With either pattern, any website a visitor opens can read the answers meant for that visitor while they are logged in, including their personal data. Tenty rates the finding high.

How Tenty checks it

Tenty sends one request with the made up origin https://cors-check.tenty.dev and reads whether the server repeats it back with credentials. It also reads the CORS headers of your page and scripts for the null origin.

How to fix it

Allow an explicit list of origins in the server. Keep the answer for credentials to that list, and ignore the value of the Origin header otherwise.

How to reproduce

curl -sSI -H 'Origin: https://cors-check.tenty.dev' 'https://YOUR-APP/'

An Access-Control-Allow-Origin that repeats the origin together with Access-Control-Allow-Credentials: true is the finding.