Stop trusting the null CORS origin

cors-null-origin

The null origin comes from sandboxed iframes and local files, so any page can claim it. Never put null in your Access-Control-Allow-Origin.

Why this matters

Your site allows data sharing with "null" origins, which can be faked using sandboxed iframes. Conditionally exploitable — requires crafting a specific attack page.

Your stack

Web servers

Nginx

Frameworks

Express Django

Nginx

1 Do not match 'null' in your origin map

nginx

map $http_origin $cors_origin {
    default "";
    # Remove this line:
    #   "null" "null";
    "https://app.example.com" $http_origin;
}

Express

1 Remove null from your CORS origin whitelist
2 Requests from sandboxed iframes and file:// send Origin: null

javascript

// Do not include null or false in your origin list
app.use(cors({
  origin: ["https://app.example.com"],  // no "null"
}));

Does your app still have this?

Scan your domain