CORS Misconfiguration WAHS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the most likely security impact of a CORS misconfiguration that allows any origin to read responses from an authenticated API?

   • AThe API's rate limiting is bypassed.
   • BThe API becomes vulnerable to SQL injection.
   • CThe server's TLS certificate is exposed.
   • DSensitive data from authenticated users can be exfiltrated by malicious websites.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a characteristic of a 'simple request' in the CORS model?

   • AIt is a request that is sent from a browser to a server on the same origin.
   • BIt uses only standard methods like GET, POST, or HEAD, and only standard headers.
   • CIt always includes the Origin header and requires a preflight.
   • DIt can use any HTTP method as long as the server allows it.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company runs a public REST API that serves non-sensitive data such as product listings. They currently set Access-Control-Allow-Origin: * and do not use cookies or any credentials. A consultant recommends a change. What is the most appropriate recommendation?

   • AReplace the wildcard with a dynamic reflection of the Origin header
   • BKeep Access-Control-Allow-Origin: * because no credentials are involved and the data is public
   • CRemove CORS headers entirely so only same-origin requests work
   • DSet Access-Control-Allow-Origin to the company's own domain only
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A developer at a financial services company is configuring CORS for an API that serves account balances. The API uses cookie-based authentication. The developer wants to allow requests from the company's own dashboard at https://dashboard.example.com and from a partner portal at https://partner.example.com. The developer considers the following configurations. Which one is the most secure and functionally correct?

   • ASet Access-Control-Allow-Origin to https://dashboard.example.com and https://partner.example.com, and Access-Control-Allow-Credentials to true.
   • BMaintain a server-side allowlist of the two origins and return the matching origin in Access-Control-Allow-Origin, with Access-Control-Allow-Credentials set to true.
   • CDynamically echo the Origin header in Access-Control-Allow-Origin and set Access-Control-Allow-Credentials to true.
   • DSet Access-Control-Allow-Origin to * and Access-Control-Allow-Credentials to true.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer is confused why a cross-origin fetch from https://client.com to https://api.com works in a browser even though the server does not send any CORS headers. The request is a simple GET with no custom headers and no credentials. What is the most likely explanation?

   • AThe fetch was made from a browser extension or a non-browser environment
   • BThe browser does not enforce the Same-Origin Policy for simple GET requests
   • CThe server must have sent Access-Control-Allow-Origin: * in a previous response that was cached
   • DThe request is a simple request, so the browser allows the response to be read without CORS
   Reveal Solution Discussion Select an answer first