hard20 pts · first answer countsweb-securitycors
Origin regex that is too loose
The CORS check uses this regex. Which origin passes that should not?
/^https:\/\/app.example.com$/.test(origin)
Discussion 0
Join free to post in the discussion.
Related questions
- Fixing a CORS errorFull Stack Developer
- What HttpOnly doesFull Stack Developer
- What HTTPS protectsFull Stack Developer
- What triggers a preflightFull Stack Developer
- Caching a bank statement pageFull Stack Developer
- Stored versus reflected XSSFull Stack Developer
- Writing location.hash into the pageFull Stack Developer
- Encoding user text inside HTMLFull Stack Developer