CORS

A CORS-preflight request: method OPTIONS, the calling page's Origin, Access-Control-Request-Method naming the method the real call will use, Access-Control-Request-Headers listing any CORS-unsafe request-header names, and Accept: /. It carries no body.

Access-Control-Expose-Headers, sent by the server on that response, names the extra fields script may read. Without it a cross-origin caller sees only seven names: Cache-Control, Content-Language, Content-Length, Content-Type, Expires, Last-Modified and Pragma.

The Origin request header carries only scheme, host and a non-default port: https://board.example.org. The path, the query, the fragment and any trailing slash are absent, and scheme and host are ASCII-lower-cased.

For two independent reasons. The preflight is sent in credentials mode "same-origin", so cross-origin it carries no cookie and no authentication entry and cannot meet the WWW-Authenticate challenge; and 401 is not an ok status, so the preflight fails regardless.

Reflection admits every origin rather than a list of them. The server compares the arriving value with nothing, so an attacker's page receives a grant identical to a partner's, and script on that page reads the response body.

Because the preflight is a separate request the browser constructs with credentials mode "same-origin", and the target is a different origin. Nothing ambient is attached to it, whatever credentials mode the real request will use.

Access-Control-Allow-Origin carries exactly one value: one serialized origin, the literal null, or the wildcard. Its grammar defines no list, so a feed serving several caller origins emits the one value that fits the current request rather than enumerating them.

The arriving value is a serialized origin, which has no path component and therefore no trailing slash. The entry is one byte longer, so an equality test over bytes fails even though a human reads the two strings as the same site.

Because the preflight's response is CORS-checked against the original request, whose credentials mode is "include" — so the server must declare that it accepts credentialed reads on a leg where it has not yet seen a credential.

Because no credential was attached to the request. The CORS grant governs whether script may read the response; it says nothing about whether the cookie travelled, so the API answered an anonymous request correctly and nothing failed.

It leaks whenever the resource's only protection is the caller's network position. On data any client could already retrieve anonymously the wildcard reveals nothing new; on an internal service it converts every employee's browser into a reader on the attacker's behalf.

CORS counts three kinds of ambient client state as credentials: HTTP cookies, TLS client certificates, and cached HTTP authentication entries. All three travel without the calling code doing anything, which is why one grant field governs all of them.

If the request's credentials mode was "include", the cookie is already stored: the browser processes Set-Cookie while fetching, before the CORS check runs. The check then refuses script the response, so the write happened and the read did not.

Nothing at all. The field's value is defined as the byte sequence true, case-sensitively, so True is not a grant; the browser behaves exactly as if the field were absent and refuses script the response.

Because a preflight's own answer is judged where it stands: the browser does not chase the redirect and judge the second response instead, and a redirect status is not an ok status, so the preflight fails and the real request is never sent.

Access-Control-Max-Age is a delta-seconds hint that populates the browser's own CORS-preflight cache. Entries are per method and per header name, not one per URL, so a new method or a newly named header preflights again.

GET, HEAD and POST remain available: they are CORS-safelisted methods and pass the check without appearing in the grant. Access-Control-Allow-Methods is a comma-separated list that adds methods beyond those three, so listing PUT removes nothing.

Re-issue the OPTIONS by hand to the exact URL the page calls, carrying the page's exact Origin and an Access-Control-Request-Method naming the real method, then judge the answer against two conditions at once: an ok status, and a CORS check that passes.

Ending in a name is not being it. The attacker registers a domain whose name ends with the allowed string, such as evilconf-schedule.example against an allowed conf-schedule.example, so the suffix test passes and the grant is issued to them.

Authorization is the CORS non-wildcard request-header name: the wildcard in Access-Control-Allow-Headers covers other unsafe request headers but never that one, so a server must list Authorization by name for a caller that sends it.

Two independent triggers attach the header: a request whose response tainting is cors, and a request whose method is neither GET nor HEAD. The second fires even when the destination is the sending host itself, so presence proves nothing about direction — only the value does.

Make the allowed set declared data with an owner, a reason and an expiry per entry, consumed by services rather than authored in them, and prove the estate's behaviour by sending unrelated origins at every route rather than by reading configuration.

Only a response header whose name is literally *. Once the request's credentials mode is "include", the wildcard in the grant fields stops being a wildcard and is matched as an ordinary field name, so nothing extra is exposed.

Every context whose origin serializes to that value, all at once. The token names no particular party, so it cannot identify the preview it was added for, and a document can be placed in such a context deliberately.

Safelisting is limited by size as well as by name: a value longer than 128 bytes disqualifies that field, and once the safelisted values total more than 1024 bytes all of them count as CORS-unsafe request-header names, so a preflight is sent.

Once a request's redirect chain crosses an origin boundary, the request's origin is treated as tainted and serializes to the literal four-byte value null instead of the caller's origin. The final host therefore receives no usable caller identity.