scorelab / Stackle

Stackle is an web communication portal aimed at providing Open Source organizations a platform to have discussions on their github projects and their issues. It provides Github intergration which allows adminstrator of an organization to create a forum thread for the particualr organization. Users signing in is able to view forums of the organizations they contribute to and engage in the forum discussions.
Apache License 2.0
104 stars 146 forks source link

Cross-Domain Misconfiguration #190

Open channa1 opened 4 years ago

channa1 commented 4 years ago

Before you describe your issue, idea or feature, please consider using this issue template.

Type of issue:

Short description on the issue

Web browser data loading may be possible, due to a Cross Origin Resource Sharing (CORS) misconfiguration on the web server

Possible fix

Ensure that sensitive data is not available in an unauthenticated manner (using IP address white-listing, for instance). Configure the "Access-Control-Allow-Origin" HTTP header to a more restrictive set of domains, or remove all CORS headers entirely, to allow the web browser to enforce the Same Origin Policy (SOP) in a more restrictive manner.