CORS Audit (cors-audit)

Summary

CORS preflight and policy checks on the target and common API paths.

Classification

• Category: SECURITY
• Plugin id: cors-audit
• Version: 1.0.0
• Target types: WEBSITE, API, WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 5 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Default 10000 ms per endpoint probe.
additionalEndpoints	Optional list of extra paths/URLs to include in the sweep.

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for cors-audit.

Endpoints checked: target URL, additionalEndpoints, and /api, /api/v1, /graphql, /api/trpc.

Check	Typical severity	Why
Wildcard origin with credentials (* + Allow-Credentials: true)	CRITICAL	Invalid/dangerous combo — indicates serious misconfiguration even if browsers block it.
Origin reflection with credentials	CRITICAL	Server echoes attacker Origin with credentials — any site can read authenticated API responses.
Wildcard CORS on API endpoint	WARNING	Access-Control-Allow-Origin: * on API paths when target.type === 'API' — any origin can read responses.
Null origin allowed	WARNING	Allow-Origin: null — exploitable via sandboxed iframes and data: contexts.

How each check works

1. Build list — Target URL + optional config endpoints + four common API paths on the same origin.
2. Probe — GET each URL with Origin: https://malicious-test-origin.com and CORS preflight-style request headers (Access-Control-Request-Method, Access-Control-Request-Headers). Note: uses GET, not OPTIONS.
3. Read response headers — Access-Control-Allow-Origin, -Methods, -Credentials, etc.
4. Rules — * + credentials → CRITICAL. If origin matches test origin and credentials true, second request with Origin: https://evil-attacker.com — if echoed → CRITICAL reflection. Allow-Origin: null → WARNING. Wildcard on endpoint when target type is API → WARNING.
5. Skip silent — Endpoints that fail fetch or return no CORS headers are counted in metrics but produce no finding.

Caveats and concerns

• Not a true OPTIONS preflight — May miss behavior that only appears on OPTIONS or authenticated requests.
• Wildcard on WEBSITE/WEBSHOP — Allow-Origin: * on HTML document is not flagged unless target type is API.
• 404 endpoints — Common paths may 404 with accidental CORS headers — still reported.
• No cookie/session test — Does not send cookies; credential reflection is header-level only.
• Duplicate paths — Same URL may appear multiple times in the list if configured in additionalEndpoints.

Source

packages/test-plugins/src/plugins/cors-audit.ts