Browser & Web Performance · Senior · Question 40 of 75

Why is allowing `Origin: null` in CORS risky?

✓Correct answer: Sandboxed iframes, file: pages and some redirects send null, so an attacker can easily produce it
2Browsers never send Origin: null
3null origins are only used by search engines

Explanation

Whitelisting null with credentials effectively allows any attacker page using a sandboxed iframe.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.