Attacker SiteCORS Demo

Attacker Demo Page

This page simulates a cross-origin attack exploiting the CORS misconfiguration.

How it works

  1. The victim visits this page while logged into Clowder (session cookie set).
  2. JavaScript fetches /api/profile with credentials: 'include'.
  3. The server reflects the attacker's origin in Access-Control-Allow-Origin.
  4. The browser allows the response to be read — the attacker extracts the data.

Fetch Result

Setting up demo session cookie and fetching...