cors-cross-origin-misconfiguration

1# SKILL: CORS Misconfiguration — Credentialed Origins, Reflection, and Trust Boundary Errors
2 
3> **AI LOAD INSTRUCTION**: Use this skill when browsers can access authenticated APIs cross-origin. Focus on reflected origins, credentialed requests, wildcard trust, parser mistakes, and origin allowlist bypasses. For JSONP hijacking deep dives, same-origin policy internals, honeypot de-anonymization, and CORS vs JSONP comparison, load the companion [SCENARIOS.md](./SCENARIOS.md).
4 
5### Extended Scenarios
6 
7Also load [SCENARIOS.md](./SCENARIOS.md) when you need:
8- JSONP hijacking complete attack scenario — watering hole + `<script>` cross-origin data theft
9- Honeypot de-anonymization via JSONP — use social platform JSONP endpoints to identify anonymous visitors
10- Same-origin policy deep dive — protocol/hostname/port definition, `document.domain` subdomain relaxation and its security risks
11- CORS vs JSONP technical comparison — methods, error handling, credential behavior, migration path
12- CORS exploitation payloads — reflected origin with `credentials: include`, null origin via sandboxed iframe
13- Dual-site attack lab pattern — localhost:8981 (target) + localhost:8982 (attacker) testing setup
14 
15## 1. WHEN TO LOAD THIS SKILL
16 
17Load when:
18 
19- Responses contain `Access-Control-Allow-Origin`, `Access-Control-Allow-Credentials`, or preflight headers
20- A browser-based attack path might read authenticated API responses
21- JSON endpoints appear protected from CSRF but are readable cross-origin
22…