CORS startsWith() allows lookalike origins Debugging Lab

CORS startsWith() allows lookalike originsSecurityEasyPreparing workspaceAutosaved

00:00

Incident Dossier

CORS startsWith() allows lookalike origins

A bug bounty report shows that registering `example.com.attacker.io` is enough to bypass our CORS allowlist. The header is happily echoed back to the attacker and authenticated cookies travel with the request.

Initial failing signallookalike origin acceptedExpected false · received true

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Read the allowlist helper and decide what string operation would refuse a lookalike domain.
Replace the comparison with one that only accepts the exact origin.
Confirm legitimate origins still pass.

Focus Mode

Start

src/cors.js

Likely area

src/cors.js

Progressive hints

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecurity

DifficultyEasy

Est. time10 min

Workspacecreating

Explorer

Preparing workspace files…

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ workspace boot

Workspace booting...