HackBlue

Labs / Web and API security

CORS and CSP evaluator

Send cross-origin requests to four CORS configurations and run scripts against three Content Security Policies, then see what the browser allows.

  • Interactive lab
  • Intermediate
  • 5 steps
  • 0 of 5 solved

Goal

Two browser rules protect https://app.contoso.example. CORS decides whether another site's script can read responses from https://api.contoso.example. Content Security Policy decides which scripts may run on the app's own pages.

Switch between the two evaluators, change the inputs, and read the reason the browser gives for each decision.

Server configuration

Page origin

Request

Server codehttps://api.contoso.example
res.set('Access-Control-Allow-Origin', req.headers.origin)
res.set('Access-Control-Allow-Credentials', 'true')
Exchange
// running on https://evil.example
fetch('https://api.contoso.example/account', { credentials: 'include' })

GET /account HTTP/1.1
Origin: https://evil.example
Cookie: session=…

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://evil.example
Access-Control-Allow-Credentials: true
Content-Type: application/json

Readable. The page at https://evil.example can read the response with the user’s cookies.

Steps

  1. 01Which configuration lets https://evil.example read a signed-in user’s data?

  2. 02Config 3 checks endsWith("contoso.example"). Which origin could an attacker register to pass it?

  3. 03Config 4 sends Access-Control-Allow-Origin: * with credentials allowed. What happens to a credentialed fetch from any origin?

  4. 04Which policy still lets an injected inline <script> run?

  5. 05Under Policy C, a widget from cdn.vendor.example runs even though that host is not listed. Which keyword allows it?