Web security · appears in CAIQ, SIG
Does the public web endpoint avoid a permissive (wildcard) CORS configuration on credentialed responses?
Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).
How to answer this
Whichever verdict your domain earns, this is the wording to put in the response box. Reviewers mark an answer down for vagueness more often than for a "No", so say which state you are in and what evidences it.
- Yes
- The public web endpoint does not advertise a permissive CORS policy
- Partial
- The CORS policy is set but with concerns worth review
- No
- The public web endpoint advertises a permissive CORS policy
Controls this evidences
| Framework | Control | Why it maps |
|---|---|---|
| SOC 2 | CC6.6 | CORS policy controls cross-origin access to application data. |
| ISO 27001 | A.8.23 | — |
| NIST 800-53 | AC-4 | — |
Domain Posture is not an audit and does not replace an auditor. See methodology v1 for how each verdict is reached.
When a "Yes" stops being true
Endpoint began advertising a permissive (wildcard-with-credentials or reflected-origin) CORS policy.
That is the whole problem with answering a questionnaire from a screenshot: the answer was true the day you took it. A signed evidence pack is dated, and a schedule re-checks it so you find out before your reviewer does.