{"id":8269,"date":"2020-09-29T11:27:43","date_gmt":"2020-09-29T11:27:43","guid":{"rendered":"https:\/\/cloudkul.com\/blog\/?p=8269"},"modified":"2021-07-19T03:37:07","modified_gmt":"2021-07-19T03:37:07","slug":"magento-2-cors-secure-your-magento2-store-from-cors-attack","status":"publish","type":"post","link":"https:\/\/cloudkul.com\/blog\/magento-2-cors-secure-your-magento2-store-from-cors-attack\/","title":{"rendered":"Magento 2 CORS: Secure your Magento2 store from CORS attack"},"content":{"rendered":"\n

So far in this Magento 2 security<\/a> series we have discussed injection<\/a>, csrf<\/a> attacks and global techniques to prevent them as well as we have checked how Webkul security module<\/a> can help us for an easy and quick fix. <\/p>\n\n\n\n

Let’s discuss another attack Cross Origin Resource Sharing (cors) which is being exploited by the attacker in the wild to steal sensitive information. <\/p>\n\n\n\n

In a typical web application, it generally fetches resources such as image , JSON data from another origin but browsers same origin policy<\/a> can restrict loading of resources from another domain.<\/p>\n\n\n\n

To fix this issue caused by same origin policy CORS can be an effective solution. By enabling CORS header the server will tell the browser to allow use of additional origin.<\/p>\n\n\n\n

But if CORS policy is poorly configured and implemented it can potentially invite cross-domain based attacks. <\/p>\n\n\n\n

Let’s check the general misconfiguration scenarios:<\/p>\n\n\n\n

1.wildcard (*) in CORS Headers:<\/strong> Here the header Access-Control-Allow-Origin is configured with a wildcard(*). It means any domain can access the resources. As the site shares information from any site it can be exploited easily.<\/p>\n\n\n\n

2. Whitelisted null origin value:<\/strong>The Origin header is set to null because the browser doesn\u2019t want to leak the origin value to the server.<\/p>\n\n\n\n

Browsers might send the value null in the Origin header in situations such as:<\/p>\n\n\n\n