cors Shipped
What this lens looks for
Cross-Origin Resource Sharing must be configured correctly or not enabled at all. The request Origin header MUST NOT simply be reflected back as Access-Control-Allow-Origin — an explicit allowlist of permitted origins must be maintained instead. * MUST NOT be combined with credentials (browsers block this, and attempting it signals a design misunderstanding). Preflight overhead SHOULD be reduced by setting Access-Control-Max-Age: 86400, and exposed headers SHOULD be minimized to only what the client actually needs. Watch for the common misconfigurations: wildcard origin together with credentials; regex origin matching that is not anchored (so evil-example.com matches a rule meant for example.com); allowing the null origin (exploitable via sandboxed iframes); and overly broad allowed methods and headers.
What its verifier checks
The Origin header is never reflected straight back into Access-Control-Allow-Origin — allowed origins come from an explicit allowlist; * is never used together with credentials (Access-Control-Allow-Credentials: true); any dynamic/regex origin matching is anchored so it cannot match attacker-controlled superstrings; the null origin is not allowed; Access-Control-Max-Age: 86400 is set to cache preflights; exposed headers (and allowed methods/headers) are minimized to only what the client needs.