Misconfigured CORS and why web appsec is not getting easier
summary
Claims a concrete fault: scanned the Alexa 1 million and finds about 1,000 sites reflecting the Origin header plus Access‑Control‑Allow‑Credentials true, effectively disabling SameOrigin. Uses curl and a concurrent Go scanner to detect the issue, builds a tiny proof‑of‑concept JavaScript using fetch/jQuery that can exfiltrate session tokens, and reports at least one live hit (streamable) that gets patched. Frames the problem alongside operational fragility in CSP, HPKP, HSTS, SRI, CORS.
AI-written summary · about
chapters (12)
- 0:00Start
- 5:09The internet is not a series of castles
- 10:18Cross Origin Resource Sharing Appropriately
- 12:51Cross Origin Resource Sharing Problem
- 14:13Testing for bad cors
- 14:59Exploit Proof of Concept
- 22:45CORS, the source
- 25:48Cross origin resource sharing could be way easier
- 27:32Content Security Policy
- 29:26HTTP Public Key Pinning
- 31:20Credential Management
- 32:14HTTP Strict Transport Security
related talks
25mWe Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS
43mAbusing Bleeding Edge Web Standards for Appsec Glory
18mWriting an (in)secure webapp
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery
30mSingle Page Applications: Is your design secure?
33mHacking The Front-End
40mContent Security Policy to the Rescue
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery