CS Fundamentals Trainer · JavaScript · Security

An API's CORS configuration allowlists the origin null (with credentials) so that a local file:// tool can call it. Why is this dangerous?

An API's CORS configuration allowlists the origin `null` (with credentials) so that a local `file://` tool can call it. Why is this dangerous?

  1. Browsers treat `null` like the `*` wildcard, so the credentials flag is ignored and cookies are sent to any server.
  2. Browsers send `Origin: null` on same-origin requests, so allowing it disables the API's CSRF protection.
  3. An attacker's page can run its code in a sandboxed iframe, whose requests carry `Origin: null`, and read credentialed responses.
  4. It lets server-side clients like curl bypass CORS, which otherwise blocks them from reading responses.

Difficulty: hard

Answer this question

Related questions