Question

During a web application assessment, you notice that an API endpoint at https://app.corp.com/api/profile returns sensitive user data and includes the response header 'Access-Control-Allow-Origin: *' along with 'Access-Control-Allow-Credentials: true'. The application uses session cookies for authentication. Which conclusion is most accurate about exploiting this configuration?

Accepted Answer

The combination is invalid per the CORS spec, so browsers will not send credentials, and the data cannot be stolen cross-origin this way.

Answer

The configuration is exploitable as-is; a malicious site can read the credentialed response from any authenticated victim's browser.

Answer

The wildcard origin fully protects the endpoint because it prevents any specific origin from being trusted.

Answer

Exploitation requires first bypassing the HttpOnly flag on the session cookie before any cross-origin read is possible.