The CORS Credential Leak
#security-critical — cross-origin session hijacking
CISO: evil-phishing.com steals session cookies and reads /api/me responses. Developer "fixed" CORS by reflecting the Origin header with `Access-Control-Allow-Credentials: true`.
The trap: Origin reflection = server trusts every website. Browser sends cookies and lets malicious JS read the response.
Your task
Fix `secureCorsMiddleware()` in `cors_server.js`: validate against `TRUSTED_ORIGINS` allowlist. Return CORS headers only for trusted domains.
Book: add CORS middleware · Prod: reflecting Origin bypasses Same-Origin Policy.
Skills you'll prove
Interview Tip
When asked how you configure CORS securely or what is dangerous about reflecting the Origin header, say: "The most dangerous CORS misconfiguration is dynamically reflecting the incoming Origin header while allowing credentials. It completely bypasses the Same-Origin Policy, allowing any malicious website to make credentialed requests and read the responses. I solve this by implementing a strict Origin Allowlist. The middleware checks the incoming origin against a hardcoded list of trusted domains. If it is not on the list, the server returns no CORS headers, and the browser blocks the cross-origin request."