API endpoint accepts an arbitrary origin with credentials
ShipReady observed a tested API endpoint allow credentials while accepting either a wildcard or the scanner's synthetic Origin value.
Why it matters
For a credentialed browser request, an origin policy that accepts arbitrary sites can allow an untrusted site to make cross-origin requests in a signed-in visitor's browser and read permitted responses.
How ShipReady detects it
What it inspects
ShipReady discovers supported API endpoints and sends a preflight request plus an actual request using a synthetic Origin header. It reads the CORS response headers.
What triggers a finding
The rule triggers when the tested response allows credentials and its allowed origin is either a wildcard or reflects the synthetic origin used by the scanner.
What the evidence shows
The observed endpoint returned the reported credential and origin CORS headers to the scanner's request.
Limits of this check
ShipReady does not sign in as a user, send application credentials, inspect every endpoint or browser, or determine which responses a real session can read. It does not prove that any particular account data was accessed.
How to fix it
Use a strict origin allowlist
Return credentialed CORS responses only for explicitly trusted origins and avoid reflecting arbitrary Origin values.
Review credentialed cross-origin endpoints
Limit credentials and cross-origin methods to endpoints that require them, and confirm application authorization remains enforced.
How to verify the change
Test trusted and untrusted origins
Use controlled browser requests from an approved origin and an unapproved origin to verify the response headers and browser behavior.
Expected: Only approved origins receive the credentialed CORS policy.