OWASPASVS 5.0 requirement
ASVS-V3.5.2 Verify that, if the application relies on the cors preflight mechanism to prevent disallowed cross-origin use of sensitive functionality,…
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.5 Browser Origin Separation
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that, if the application relies on the CORS preflight mechanism to prevent disallowed cross-origin use of sensitive functionality, it is not possible to call the functionality with a request which does not trigger a CORS-preflight request. This may require checking the values of the 'Origin' and 'Content-Type' request header fields or using an extra header field that is not a CORS-safelisted header-field.