CORS

CORS Credential Theft

Scenario

ProfileAPI returns private JSON for the logged-in user at a me endpoint. Responses include Access-Control-Allow-Origin reflecting the request Origin. Steal the JSON from a page hosted on an attacker-controlled origin.

Your approach

Log in and call the me API from browser dev tools to see normal data.
Use the lab's evil origin simulator or your own page with fetch credentials.
Confirm the browser exposes the response body cross-origin.
Copy the flag field from the leaked JSON.
Submit the CORS theft flag.

The API at /labs/cors/1/api/me reflects Origin and sets Access-Control-Allow-Credentials: true. From an attacker page you'd fetch it with credentials. Use the demo exploit box below (simulates evil.com).

Victim API (same origin preview)

// response

Evil origin simulator

Sends the request with a spoofed analysis of reflected ACAO. Paste any Origin; if the API would allow it with credentials, you get the flag.

Attacker Origin