https://souljian.cn/tags/%E9%85%8D%E7%BD%AE%E9%94%99%E8%AF%AF/Recent content in 配置错误 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088154/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088154/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>CORS 测试只在授权测试环境进行。</p> <h2 id="一cors-配置错误">一、CORS 配置错误 </h2><img src="https://souljian.cn/img/cors-config-error.svg" alt="CORS 配置错误" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Allow-Origin: * + Allow-Credentials: true = 凭证泄露 </span></span><span class="line"><span class="cl">反射 Origin：不校验可信域名 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二攻击方式">二、攻击方式 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">构造恶意页面 → 携带 Cookie 请求目标 API </span></span><span class="line"><span class="cl">→ 浏览器允许跨域 → 读取响应内容 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三验证命令">三、验证命令 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">curl -H <span class="s2">&#34;Origin: http://evil.com&#34;</span> http://target/api </span></span><span class="line"><span class="cl"><span class="c1"># 查看返回头中的 Access-Control-Allow-*</span> </span></span></code></pre></td></tr></table> </div> </div><h2 id="四防御方法">四、防御方法 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">白名单：只允许可信域名列表 </span></span><span class="line"><span class="cl">凭证保护：SameSite=Strict Cookie </span></span><span class="line"><span class="cl">API 安全：敏感 API 要求 HTTPS + Token 认证 </span></span><span class="line"><span class="cl">监控：记录 Origin 请求日志 · 异常告警 </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>CORS 配置错误的核心是<strong>信任了不可信的 Origin</strong>。防御核心是<strong>白名单校验 + 禁止 * + Credentials 组合</strong>。</p>