cors-misconfiguration

Name: cors-misconfiguration
Availability: InStock
Author: Q16G

Analyze CORS response headers to identify misconfigurations in web APIs.

83|8|Updated May 6, 2026

Search Tags:#web-security #api-testing #cors #misconfiguration #evidence-chain #security-auditing

Ready to run

npx skills add https://github.com/Q16G/aster --skill cors-misconfiguration-q16g

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cors-misconfiguration
Source: https://github.com/Q16G/aster/tree/main/skills/pentest/cors-misconfiguration
Command: npx skills add https://github.com/Q16G/aster --skill cors-misconfiguration-q16g

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

识别和修复跨域资源共享（CORS）配置错误，防止潜在的数据暴露和越权访问。常见问题包括 Access-Control-Allow-Origin 的不当反射、ACAO: * 与凭证跨域读取的冲突，以及对 null Origin 的错误信任等。

Core Features & Use Cases

自动检测常见的 CORS 配置错误，如 ACAO 反射、ACAO: * 与凭证跨域读取的冲突，以及对 null Origin 的错误信任。
针对 Web API、网关代理和前后端分离场景提供端到端的 CORS 安全评估与复核证据。
提供可复核的证据链和风险等级输出，帮助开发与安全团队快速修复。

Quick Start

运行 cors-misconfiguration 对目标 API 端点执行基线与变体请求检测，验证 CORS 头部是否安全且不暴露敏感数据。

Frequently Asked Questions about cors-misconfiguration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect CORS misconfigurations in my web API response headers?▼

To detect CORS misconfigurations, scan baseline and malicious-origin requests to compare ACAO, ACAC, and Vary header behavior, producing an actionable evidence chain with risk levels for your API endpoints.

What causes CORS data exposure when Access-Control-Allow-Origin reflects any origin?▼

CORS data exposure occurs when Access-Control-Allow-Origin improperly reflects arbitrary origins, especially combined with credentials, allowing unauthorized cross-origin reads of sensitive API data across microservice architectures.

How do I test for null origin trust issues in API gateway proxies?▼

Test for null origin trust by sending crafted requests with a null Origin value to your gateway proxies and analyzing if the ACAO header incorrectly validates and reflects it, exposing cross-origin request vulnerabilities.

Can I automate security auditing for cross-origin requests in microservice architectures?▼

Yes, you can automate security auditing for cross-origin requests by running variant request scans against microservice architectures to verify ACAO and ACAC headers, generating a reviewable evidence chain with assigned risk levels.

Why does Access-Control-Allow-Origin: * conflict with cross-origin credential reading?▼

Access-Control-Allow-Origin: * conflicts with credential reading because browsers block credentialized cross-origin requests when the API uses a wildcard, requiring precise ACAO reflection validation to prevent security misconfigurations.

What are the limitations of scanning baseline requests for CORS misconfiguration evidence?▼

Scanning baseline requests for CORS evidence requires comparing malicious-origin variants to accurately assess Vary header behavior, meaning isolated baseline checks may miss dynamic ACAO reflection flaws in complex gateway proxies.