cors-misconfiguration

To detect CORS misconfigurations, scan baseline and malicious-origin requests to compare ACAO, ACAC, and Vary header behavior, producing an actionable evidence chain with risk levels for your API endpoints.

CORS data exposure occurs when Access-Control-Allow-Origin improperly reflects arbitrary origins, especially combined with credentials, allowing unauthorized cross-origin reads of sensitive API data across microservice architectures.

Test for null origin trust by sending crafted requests with a null Origin value to your gateway proxies and analyzing if the ACAO header incorrectly validates and reflects it, exposing cross-origin request vulnerabilities.

Yes, you can automate security auditing for cross-origin requests by running variant request scans against microservice architectures to verify ACAO and ACAC headers, generating a reviewable evidence chain with assigned risk levels.

Access-Control-Allow-Origin: * conflicts with credential reading because browsers block credentialized cross-origin requests when the API uses a wildcard, requiring precise ACAO reflection validation to prevent security misconfigurations.

Scanning baseline requests for CORS evidence requires comparing malicious-origin variants to accurately assess Vary header behavior, meaning isolated baseline checks may miss dynamic ACAO reflection flaws in complex gateway proxies.