Web Security · Middle · Question 33 of 75

Why should `Access-Control-Allow-Origin: null` never be allowed with credentials?

1Because null means the request came from the same server
2Because null turns CORS off
✓Correct answer: Sandboxed iframes and data: URLs send Origin: null, so an attacker can easily produce it

Explanation

Trusting null for local development often ends up in production and lets any page that makes a sandboxed iframe read your data.

Further reading

PortSwigger Web Security Academy: CORS ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.