CS Fundamentals Trainer · JavaScript · Security

An API answers every request with Access-Control-Allow-Origin: <the request's Origin header> and Access-Control-Allow-Credentials: true.…

An API answers every request with `Access-Control-Allow-Origin: <the request's Origin header>` and `Access-Control-Allow-Credentials: true`. What is the risk?

  1. Browsers reject reflected values, so legitimate cross-origin clients break, but no data leaks.
  2. None while the session cookie is `HttpOnly`, because scripts on other origins are unable to read it.
  3. Attackers can read the user's cookies from `document.cookie` on the API's origin.
  4. Any site a logged-in user visits can call the API with the user's cookies and read the responses.

Difficulty: hard

Answer this question

Related questions