Web Security · Middle · Question 32 of 75

A server allows any origin that ends with `example.com`. What's the flaw?

1Subdomains of example.com are blocked
✓Correct answer: An attacker can register evil-example.com, which also matches
3It only works for HTTP, not HTTPS

Explanation

Loose string checks and broken regexes are common CORS bugs. Parse the origin and compare the full host against a list.

Further reading

PortSwigger Web Security Academy: CORS ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.