CORS allows the null origin unconditionally Debugging Lab

CORS allows the null origin unconditionallySecurityHardPreparing workspaceAutosaved

00:00

Incident Dossier

CORS allows the null origin unconditionally

Security QA runs the API inside a sandboxed iframe to verify cross-origin behaviour and finds the browser happily attaches credentials and reads the response. The null origin from the sandbox is being reflected back as the allowed origin.

Initial failing signalnull origin in sandboxed context is allowedExpected false · received true

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Notice that the CORS helper returns `allow: true` whenever the request origin is null.
Sandboxed iframes and file:// pages can present a null Origin header.
Reject null unconditionally and only echo back origins on the trusted allowlist.

Focus Mode

Start

src/cors.js
src/context.js

Likely area

src/cors.js
src/context.js

Progressive hints

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecurity

DifficultyHard

Est. time22 min

Workspacecreating

Explorer

Preparing workspace files…

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ workspace boot

Workspace booting...