Check CORS and security headers set in code

Jul 2, 2026 · 1 min read

Find where CORS headers are written and whether the origin is reflected together with credentials.

bash

grep -rEn "Access-Control-Allow-Origin|cors(|@CrossOrigin|add_header .*Origin" --include=*.{js,ts,py,java,go,conf} .

The dangerous combination reflects the origin and allows credentials.

javascript

res.header("Access-Control-Allow-Origin", req.headers.origin);
res.header("Access-Control-Allow-Credentials", "true");

Pro note: a wildcard origin cannot be combined with credentials by browsers, which is why developers reflect the origin, and that is exactly the bug. Require an explicit allow-list. Also confirm the app is not trusting null origin from sandboxed iframes.