The Ravens account API reflects whatever Origin the client sends into Access-Control-Allow-Origin and allows credentials, so any site can read the authenticated account response.
A CORS test page where you enter the origin of a page you control; it fetches the account API and shows the allow headers and whether your page could read the authenticated response.
Make a page on your origin read the account response.
You read the account response from an origin you control.
Why the solution worked
Reflecting the origin with credentials allowed means any site reads the victim authenticated data. The fix is a fixed allowlist of trusted origins matched exactly, not reflecting whatever arrives.
The root cause
Reflecting the origin into the allow header with credentials. The root is trusting the request origin to decide who may read.
How the code is fixed
Use a fixed allowlist of trusted origins; never reflect the request origin.
Vulnerable code
res.setHeader('Access-Control-Allow-Origin', req.headers.origin); // reflects anything
res.setHeader('Access-Control-Allow-Credentials', 'true');
Safe code
const ALLOW = new Set(['https://account.ravens.lab', 'https://www.ravens.lab']);
if (ALLOW.has(req.headers.origin)) res.setHeader('Access-Control-Allow-Origin', req.headers.origin);
Impact in the real world
CORS misconfiguration leaks authenticated account data to any site the victim visits, and has leaked real user data.
How defenders detect it
Defenders use a fixed allowlist and alert on responses that reflect the origin with credentials allowed.
