CORS Misconfiguration WAHS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement correctly describes the relationship between the Same-Origin Policy and CORS?

   • AThe Same-Origin Policy is a server-side access control list that CORS overrides.
   • BThe Same-Origin Policy applies only to requests made with XMLHttpRequest, not to fetch.
   • CCORS completely removes the Same-Origin Policy for all requests.
   • DCORS is a browser mechanism that can selectively relax the Same-Origin Policy for cross-origin requests.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is evaluating the risk of a CORS misconfiguration in a public API that does not use cookies but uses a bearer token in the Authorization header. The API reflects any Origin header but does not set Access-Control-Allow-Credentials. Which statement best describes the risk?

   • AThe risk is the same as with cookies because the browser sends the Authorization header automatically.
   • BThe risk is mitigated because the API does not set Access-Control-Allow-Credentials.
   • CThe risk is lower because the attacker cannot force the victim's browser to include the bearer token automatically.
   • DThe risk is higher because the attacker can read the Authorization header from the response.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is migrating a legacy web application to a microservices architecture. The new API will be accessed by a React dashboard on a different subdomain. The API uses cookie-based authentication. The team wants to avoid CORS misconfigurations. Which approach is the most secure and maintainable?

   • AUse a reverse proxy to serve the dashboard and API from the same origin.
   • BDisable CORS and require the dashboard to use JSONP.
   • CSet Access-Control-Allow-Origin to * and rely on the dashboard's authentication.
   • DReflect the Origin header but only allow origins ending in .example.com.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is designing a CORS policy for a new API that will be used by multiple partner applications, each with a different subdomain of partner.example.com (e.g., app1.partner.example.com, app2.partner.example.com). The API uses cookie-based authentication. The team wants to allow all partner subdomains but no others. Which approach is the most secure and maintainable?

   • ASet Access-Control-Allow-Origin to *.partner.example.com.
   • BSet Access-Control-Allow-Origin to * and rely on the authentication mechanism.
   • CReflect the Origin header if it ends with .partner.example.com.
   • DMaintain a database of exact partner origins and validate the Origin header against it.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security architect is reviewing a CORS configuration for a banking API. The API is accessed by a legacy partner application that sends the Origin header as null because it runs in a sandboxed iframe. The partner cannot change its application. The architect must allow this partner while preventing other null-origin attacks. What is the most secure solution?

   • ABlock all null-origin requests and tell the partner to use a different origin
   • BUse a wildcard origin with credentials for the partner's requests
   • CAllow Origin: null only when a custom token header is present and valid
   • DAllow Origin: null for all requests because the partner needs it
   Reveal Solution Discussion Select an answer first