This is a **P0 security misconfiguration** under OWASP **A05/API8**. `Access-Control-Allow-Origin: *` must not be used on authenticated routes. Remediate by: - Replacing `*` with an explicit origin allowlist, e.g. `https://app.example.com`. - Enabling `Access-Control-Allow-Credentials: true` only when required, never alongside `*`. - Keeping authentication and authorization enforced server-side; CORS is not an authorization control. - Using an opaque session securely or JWTs with an `exp` cla...
Scanned 9/5/2026
Install to Claude Code
Skills Directorynpx -y skills add HoangNguyen0403/agent-skills-standard --skill common-owasp --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Common Owasp?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-common-owasp-b6fcfbaf)More formats (shields.io, HTML) on the badges page.
This is a **P0 security misconfiguration** under OWASP **A05/API8**. `Access-Control-Allow-Origin: *` must not be used on authenticated routes.
Remediate by:
- Replacing `*` with an explicit origin allowlist, e.g. `https://app.example.com`.
- Enabling `Access-Control-Allow-Credentials: true` only when required, never alongside `*`.
- Keeping authentication and authorization enforced server-side; CORS is not an authorization control.
- Using an opaque session securely or JWTs with an `exp` claim.
- Applying rate limiting to authenticated and sensitive endpoints.
- Checking every resource query for IDOR/BOLA protection with `owner_id`/`tenantId`.
- Returning DTO projections rather than full ORM entities.
Assumption: these routes are browser-accessible APIs and may process cookies or bearer tokens.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
Use this skill when developing or maintaining browser extension code in the `browser/` directory, including Chrome/Firefox/Edge compatibility, content scripts, background scripts, or i18n updates.
Official Google SEO guide covering search optimization, best practices, Search Console, crawling, indexing, and improving website search visibility based on official Google documentation
SEO optimization with keyword analysis, readability assessment, technical validation, content quality. Use for search rankings, blog posts, content audits, or encountering keyword density, readability scores, meta tags, schema markup errors.
Python backend development expertise for FastAPI, security patterns, database operations, Upstash integrations, and code quality. Use when: (1) Building REST APIs with FastAPI, (2) Implementing JWT/OAuth2 authentication, (3) Setting up SQLAlchemy/async databases, (4) Integrating Redis/Upstash caching, (5) Refactoring AI-generated Python code (deslopification), (6) Designing API patterns, or (7) Optimizing backend performance.
PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.
