Allowlisting an application for CORS - Port Swigger
Summary: PortSwigger's documentation explains that Burp Suite DAST's GraphQL API requires client-side JavaScript applications to allowlist their origin for cross-origin resource sharing, entering the URL scheme, domain name, and port in the Allowed Origins section. It notes that allowlisting applies to the whole origin and cannot be restricted to subdirectories such as https://example.com:8080/my-app, so more granular control requires deploying the application to a dedicated subdomain.
Bottom line: CORS allowlisting here operates at origin level only, so any application sharing that scheme, domain, and port inherits the same access - a detail that matters when deciding how many origins to trust.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026