CORS misconfiguration: trusting the wrong Origin

The Same-Origin Policy stops one site from reading another's responses. CORS relaxes it in a controlled way — if misconfigured, it throws it wide open.

The mistakes

Reflecting the Origin: the server echoes Access-Control-Allow-Origin = whatever Origin it received, with Allow-Credentials: true. A malicious site makes authenticated requests (with the victim's cookies) and reads the response.

Origin: https://evil.com
-> Access-Control-Allow-Origin: https://evil.com
   Access-Control-Allow-Credentials: true   # reads private data

Others: null in the whitelist (obtainable from a sandboxed iframe), substring matching (evil-company.com).

Defence

Explicit whitelist of trusted origins, exact match, never blind reflection. Do not pair Allow-Credentials: true with dynamic origins or *. Treat CORS as authorization: a wrong origin reads private data.