CORS Misconfigured Headers — SAMPLE
Intentionally misconfigured CORS SAMPLE (* + credentials) for policy linters.
# Intentionally loose / misconfigured CORS SAMPLE for negative tests
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Specifications
- Issue
- ACA-Origin * with credentials
- Valid Policy
- false
Testing contract
Expected to pass- Scenario
- Exercise CORS Misconfigured Headers — SAMPLE in its headers workflow. Intentionally misconfigured CORS SAMPLE (* + credentials) for policy linters.
- Expected result
- 3 text lines, decoded as UTF-8; first nonempty line is '# Intentionally loose / misconfigured CORS SAMPLE for negative tests'. Declared feature checks: issue=ACA-Origin * with credentials; validPolicy=False.
What is a .headers file?
A .headers text fixture is a plain-text dump of HTTP response headers (CORS, CSP, HSTS, etc.) used for policy and scanner tests.
How to use this file
Use SAMPLE .headers files to test security-header parsers and linters against documented good and misconfigured policies.
How to use this file for testing
“CORS Misconfigured Headers — SAMPLE” is a deterministic Novus Examples fixture for API testing, Error handling. OpenAPI/Swagger specs, GraphQL SDL, JSON Schema, paginated and problem+json error payloads, and webhook samples, for testing API clients, mock servers, contract tests, and schema validators.
Documented properties for this file: HEADERS · 142 bytes. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such, expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material, never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
Related files
- jsonOAuth Token Error — SAMPLESAMPLE OAuth error JSON for token-endpoint failure handling.
- jsonDependency Alerts Feed (JSON)The shape a hosted dependency-alert API returns: alerts with lifecycle state, a nested advisory, a patched-version pointer and an explicitly null dismissed_reason on the alerts that were not dismissed. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonGraphQL Error Response (JSON)GraphQL error response with message and location — negative case for GraphQL clients.
- jsonPrometheus HTTP API — Error Envelope with a PromQL Parse Error (json)The error envelope a Prometheus API returns for a malformed PromQL query — status, errorType, a message with a line and column position, and an empty but present data object. Clients that only check for a data key render this as a successful empty result.
- headersBrowser Security Headers Pack — SAMPLESAMPLE Permissions-Policy / Referrer-Policy / XCTO / XFO header pack.
- headersContent-Security-Policy Header — SAMPLESAMPLE CSP header line for CSP parsers and security-header scanners.
Generated by generation/security_wave_g.py. Free for any use, no attribution required, license.