What a security headers check tells you and what it misses
A security headers check reads your live response for HSTS, CSP and 3 other headers. Learn how to read the result and what a clean grade leaves untested.
BattleTester Blog
Page 2
CORS misconfiguration mitigation: fixes for each common mistake
Fix the 4 common CORS mistakes: wildcard with credentials, reflected Origin, allow-all shortcuts and internal wildcards. Then verify the headers changed.
How to check for CORS misconfiguration on your own site
Send a request with a foreign Origin header and read 2 response headers. See which CORS responses are dangerous, how to rate them (CWE-942) and how to fix them.