cors-cross-origin-misconfigurationlisted

# SKILL: CORS Misconfiguration — Credentialed Origins, Reflection, and Trust Boundary Errors > **AI LOAD INSTRUCTION**: Use this skill when browsers can access authenticated APIs cross-origin. Focus on reflected origins, credentialed requests, wildcard trust, parser mistakes, and origin allowlist bypasses. For JSONP hijacking deep dives, same-origin policy internals, honeypot de-anonymization, and CORS vs JSONP comparison, load the companion [SCENARIOS.md](./SCENARIOS.md). ### Extended Scenarios Also load [SCENARIOS.md](./SCENARIOS.md) when you need: - JSONP hijacking complete attack scenario — watering hole + `<script>` cross-origin data theft - Honeypot de-anonymization via JSONP — use social platform JSONP endpoints to identify anonymous visitors - Same-origin policy deep dive — protocol/hostname/port definition, `document.domain` subdomain relaxation and its security risks - CORS vs JSONP technical comparison — methods, error handling, credential behavior, migration path - CORS exploitation payloads — reflected origin with `credentials: include`, null origin via sandboxed iframe - Dual-site attack lab pattern — localhost:8981 (target) + localhost:8982 (attacker) testing setup ## 1. WHEN TO LOAD THIS SKILL Load when: - Responses contain `Access-Control-Allow-Origin`, `Access-Control-Allow-Credentials`, or preflight headers - A browser-based attack path might read authenticated API responses - JSON endpoints appear protected from CSRF but are readable cross-origin ##