# Aperture Metrics — CORS Misconfiguration (lab)

> Aperture Metrics' /api/data endpoint reflects any Origin header it receives back in Access-Control-Allow-Origin, alongside Access-Control-Allow-Credentials: true.

Canonical: https://codelivly.com/labs/cors-misconfiguration

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 250 |
| Session length | 30 min |
| Completions | 0 |

Aperture Metrics' /api/data endpoint reflects any Origin header it receives back in Access-Control-Allow-Origin, alongside Access-Control-Allow-Credentials: true. Read the handler, fix the validation, and prove it with the built-in checker.

## Objective

Learn to recognise and fix a CORS misconfiguration: reflecting an arbitrary Origin header back in Access-Control-Allow-Origin, combined with Access-Control-Allow-Credentials: true, tells every browser on the internet that any site may read this response WITH the signed-in user's cookies attached. You will not be asked to build an attack page — the lab shows you the dangerous request and its response. Your job is to patch the handler.

## Tasks

1. Open the lab and read the handler
2. See the risk, without crafting anything
3. Add an allow-list
4. Keep credentials inside the allow-listed branch
5. Run the checker

## Related

- [All labs](https://codelivly.com/practice?type=lab)