CORS origin parsing bug Debugging Lab

CORS origin parsing bugSecurityMediumPreparing workspaceAutosaved

00:00

Incident Dossier

CORS origin parsing bug

A bug bounty hunter reported that our CORS configuration allows any domain that ends with our domain name, or has a different character instead of the dot.

Initial failing signalhidden.test.mjs fails on malicious domainsExpected false · received true

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Compare allowed first-party origins with suffix lookalikes.
Trace how the configured domain becomes an origin matcher.
Keep legitimate origins working while rejecting lookalikes.

Focus Mode

Start

src/index.js

Likely area

src/index.js

Progressive hints

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecurity

DifficultyMedium

Est. time15 min

Workspacecreating

Explorer

Preparing workspace files…

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ workspace boot

Workspace booting...