Error in CORS snippet

[alafef]

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
According to the documentation, Cookies cannot be passed with ACAO: * and ACAC: true
This happens in a CORS code snippet

[brumensywh]

Hey Alafef,

In the CORS snippet, your able to control the Origin to overwrite the wildcard (*), You can use this to exploit the code.
For example, if you add Origin: example.com you will see that the ACAO will change it's value to your requested host.
I hope that helps, otherwise let me know!

Regards,
Brumens

[alafef]

Hi
That's correct, but the request may not include Origin header. Code sets a wildcard but the response is returned as if the request was with a cookie header.

I think you should have set up headers like this code:

if (!req.headers['origin'] || req.headers['origin'] === 'null') {
        origin = '*';
      } else {
        origin = req.headers['origin'];
        res.setHeader('Access-Control-Allow-Credentials', 'true');
      }

What's in the lab now:

Request returned "sensitive" information, but the cookies were not actually sent

Response comes to the request without cookies

This is all to say that the meaning of the laboratory is lost in this case.

Regards,
Alafef

[brumensywh]

Ah!

I see what you mean!
I will take a look at this as soon as I got time, I will see how I can fix this.

Thank you for letting me know, that's very appreciated!