Cross-domain POST
Summary: PortSwigger Research describes applications that use POST requests to transfer sensitive information from one domain to another, noting this does not necessarily constitute a security vulnerability but does create a trust relationship between the two domains. The guidance is that data transmitted between domains should be reviewed to determine whether the originating application should be trusting the receiving domain with that information.
Bottom line: Every cross-domain POST your application makes is a trust decision, and the receiving domain is on the other end of it - if that domain is compromised or was never meant to hold the data, the exposure happens without any scanner flagging it as a vulnerability.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026