Cross Origin Resource Sharing (CORS) is a way to punch hole in the security brought by a browser. If it is not done carefully, it may result into security vulnerabilities. CORS is an HTTP-header that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. null can be set by server for various reasons including support for local development. However, whitelisting null could be dangerous as some crafted requests e.g. iframe can have null origin and allows an adversary to access the resource cross-domain.

Remediation

Do not set null origin.

Metadata

• Severity: informational
• Slug: cors-null-origin-allowed

CWEs

• 346: Origin Validation Error

OWASP

• A07:2021: Identification and Authentication Failures