auditing-cors-policy

name	auditing-cors-policy
description	Audit a target's CORS posture — Access-Control-Allow-Origin handling, reflected-origin bypass, credentials+wildcard mismatch, preflight OPTIONS behavior, Vary header correctness. Use when: a third-party integration is failing CORS preflight and someone proposes "just set Allow-Origin to *" as the fix, OR your bug-bounty inbox has a credential-reuse exploit chain. Threshold: any reflection of arbitrary Origin into Allow-Origin, Allow-Credentials:true with wildcard origin (browser-rejected combo but server config wrong), missing Vary:Origin on per-origin responses, preflight cached over 86400s, OR Allow-Origin trust of attacker- controlled subdomain pattern. Trigger with: "audit cors", "check cors policy", "cors bypass", "preflight check".
allowed-tools	["Read","Bash(python3:*)","Bash(curl:*)"]
disallowed-tools	["Bash(rm:*)","Edit(/etc/*)"]
version	3.30.0
author	Jeremy Longshore <[e-mail]>
license	MIT
compatibility	Designed for Claude Code
tags	["security","cors","web","pentest"]

Auditing CORS Policy

Overview

CORS misconfiguration is one of the most common middle-severity findings in web bug bounties. The browser-enforced rules are subtle, the failure modes are silent (the wrong cors response just works until an attacker weaponizes it), and the "fix" engineers reach for — Access-Control-Allow-Origin: * — opens the very class of attacks CORS was meant to prevent when paired with credentials.

This skill probes each common CORS misconfiguration with synthetic Origin headers and grades the response.

When the skill produces findings

Finding	Severity	Threshold	Affected control
Origin reflected without validation	HIGH	Synthetic Origin https://attacker.example echoed in Allow-Origin	OWASP A05:2021
Allow-Credentials:true with wildcard Allow-Origin	CRITICAL	Browser rejects but server is asserting the worst combo	OWASP A05:2021
Allow-Credentials:true with reflected Origin	CRITICAL	Attacker site can read authenticated responses cross-origin	OWASP A05:2021, CWE-942
Subdomain wildcard pattern bypass	HIGH	Allow-Origin: *.example.com matches attacker.example.com.evil.com	CWE-942
Missing Vary:Origin on per-origin response	MEDIUM	CDN caches one origin's response for all origins	RFC 7234
Preflight cache > 86400s	LOW	Access-Control-Max-Age over 24h limits revocation agility	MDN best practice
Null Origin trusted	HIGH	Allow-Origin: null accepted (sandboxed iframes, data: URLs)	CWE-942
All HTTP methods permitted	MEDIUM	Allow-Methods: * enables CSRF-via-CORS for state-change	OWASP A05:2021

Prerequisites

• Python 3.9+ (requests library)
• Authorization for non-local targets (../analyzing-tls-config/references/AUTHORIZATION.md)