Validating CORS Policies

Overview

Validate Cross-Origin Resource Sharing configurations in web applications and APIs for security misconfigurations that enable unauthorized cross-origin access. This skill analyzes CORS headers, middleware configurations, and server response behavior to detect wildcard origins, reflected origins, credential leakage, and overly permissive header/method exposure.

Prerequisites

• Access to the target codebase and configuration files in ${CLAUDE_SKILL_DIR}/
• For live endpoint testing: WebFetch tool available and target URLs accessible
• Familiarity with the web framework in use (Express, Django, Flask, Spring, ASP.NET, etc.)
• Reference: ${CLAUDE_SKILL_DIR}/references/README.md for CORS specification details, common vulnerability patterns, and example policies

Instructions

1. Locate all CORS configuration points by scanning for Access-Control-Allow-Origin, cors() middleware, @CrossOrigin annotations, CORS policy builders, and server config directives (nginx add_header, Apache Header set) using Grep.