Origin validation errors occur when software fails to properly verify where a request or piece of data is coming from. This weakness allows attackers to bypass…
Origin validation errors occur when software fails to properly verify where a request or piece of data is coming from. This weakness allows attackers to bypass security controls that depend on origin checks — most commonly Cross-Origin Resource Sharing (CORS) policies, but also referrer validation, host header checks, and similar mechanisms. A misconfigured or missing origin check can allow unauthorized cross-origin requests to succeed, leading to data theft or unauthorized actions.
Web browsers enforce the Same-Origin Policy to prevent scripts on one domain from accessing resources on another without explicit permission. Developers implement origin validation to control which external sites can interact with their application — typically via CORS headers, referrer checks, or host validation. The weakness arises when this validation is absent, incomplete, or incorrectly implemented. Common mistakes include accepting all origins (*), failing to validate the origin header at all, using string matching instead of proper parsing, or trusting client-controlled headers without server-side verification. An attacker can then craft a request from a malicious origin that the application incorrectly accepts.
A misconfigured origin check can allow an attacker to perform actions on behalf of a legitimate user without their knowledge. For example, a malicious website could make requests to a victim's bank or email account if the origin validation is weak, potentially transferring funds, reading messages, or changing account settings. In API contexts, an attacker could exfiltrate sensitive data by making cross-origin requests that should have been blocked. The severity depends on what actions the affected endpoint performs and what data it exposes.
from flask import Flask, request, jsonify
app = Flask(__name__)
@app.route('/api/transfer', methods=['POST'])
def transfer_funds():
origin = request.headers.get('Origin', '')
# Vulnerable: accepts any origin containing the domain name
if 'example.com' in origin:
amount = request.json.get('amount')
recipient = request.json.get('recipient')
# Process transfer...
return jsonify({'status': 'success'})
return jsonify({'error': 'forbidden'}), 403Why it's vulnerable:
The check uses substring matching ('example.com' in origin) instead of exact comparison. An attacker could send a request from attacker.example.com.evil.com and bypass the check. Additionally, the origin header is client-controlled and should never be the sole basis for trust.
from flask import Flask, request, jsonify
from urllib.parse import urlparse
app = Flask(__name__)
ALLOWED_ORIGINS = {'https://example.com', 'https://app.example.com'}
@app.route('/api/transfer', methods=['POST'])
def transfer_funds():
origin = request.headers.get('Origin')
# Fixed: exact match against allowlist
if origin not in ALLOWED_ORIGINS:
return jsonify({'error': 'forbidden'}), 403
amount = request.json.get('amount')
recipient = request.json.get('recipient')
# Process transfer...
return jsonify({'status': 'success'})<?php
header('Access-Control-Allow-Credentials: true');
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
// Vulnerable: wildcard allows any origin
if ($origin) {
header('Access-Control-Allow-Origin: *');
}
// Process sensitive request
$user_id = $_POST['user_id'];
$action = $_POST['action'];
// Perform action...
?>Why it's vulnerable:
Using Access-Control-Allow-Origin: * with credentials enabled violates CORS security. The wildcard means any website can make authenticated requests to this endpoint. Additionally, no validation of the origin header itself occurs.
<?php
$allowed_origins = [
'https://example.com',
'https://app.example.com'
];
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
// Fixed: exact match against allowlist
if (in_array($origin, $allowed_origins, true)) {
header('Access-Control-Allow-Origin: ' . $origin);
header('Access-Control-Allow-Credentials: true');
} else {
http_response_code(403);
exit('Forbidden');
}
// Process sensitive request
$user_id = $_POST['user_id'];
$action = $_POST['action'];
// Perform action...
?>Origin headers against it using exact string matching, never substring or regex patterns.
Access-Control-Allow-Origin: * in combination with Access-Control-Allow-Credentials: true; the wildcard and credentials are mutually exclusive for security.
Host header on the server side to ensure requests are directed at your intended domain, not a subdomain or attacker-controlled host.
Referer or Origin header for security decisions; these are client-controlled and can be spoofed. Use them only as a supplementary check alongside server-side session validation.
Check your application's HTTP response headers for overly permissive CORS settings: if you see Access-Control-Allow-Origin: * or Access-Control-Allow-Origin: * paired with credentials enabled, your origin validation may be misconfigured. Review your server logs for requests with unexpected Origin or Host headers that were processed successfully; this could indicate an attacker probing or exploiting weak origin checks. If you have received reports of unauthorized actions (fund transfers, data access, account changes) that users did not initiate, weak origin validation may be a contributing factor.
