OWASPASVS 5.0 requirement
ASVS-V3.4.2 The cross-origin resource sharing (cors) access-control-allow-origin header field is a fixed value by the application, or if the origin…
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.4 Browser Security Mechanism Headers
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that the Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin header field is a fixed value by the application, or if the Origin HTTP request header field value is used, it is validated against an allowlist of trusted origins. When 'Access-Control-Allow-Origin: *' needs to be used, verify that the response does not include any sensitive information.