CORS & SOP: Backbone of web security Whenever you are testing a website for cross-domain attacks such as XSS, CSRF, Clickjacking, etc. you must encounter with CORS, SOP and CSPs. Most of the …

InfoSecWriteUps' platform is  dedicated to providing insights and resources for cybersecurity professionals and enthusiasts. Through articles, tutorials, and security research, InfoSecWriteUps offers insights into cybersecurity vulnerabilities, attack techniques, and defense strategies. Readers can learn about penetration testing, threat intelligence, and incident response to enhance their cybersecurity knowledge and skills.

InfoSec Write-ups

A foundational overview of Same-Origin Policy (SOP) and Cross-Origin Resource Sharing (CORS) as browser security mechanisms. Covers the history of SOP from Netscape Navigator in 1995, how CORS relaxes SOP restrictions, common CORS misconfiguration vulnerabilities (reflected origins, whitelist parsing errors, null origin whitelisting), and practical prevention guidelines including avoiding wildcards, validating origins, and not treating CORS as a substitute for server-side security.

CORS & SOP: Backbone of web security

Vulnerabilities arising from CORS configuration issues