CORS Misconfigured Headers — SAMPLE
Intentionally misconfigured CORS SAMPLE (* + credentials) for policy linters.
# Intentionally loose / misconfigured CORS SAMPLE for negative tests
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Specifications
- Issue
- ACA-Origin * with credentials
- Valid Policy
- false
What is a .headers file?
A .headers text fixture is a plain-text dump of HTTP response headers (CORS, CSP, HSTS, etc.) used for policy and scanner tests.
How to use this file
Use SAMPLE .headers files to test security-header parsers and linters against documented good and misconfigured policies.
How to use this file for testing
“CORS Misconfigured Headers — SAMPLE” is a deterministic Novus Examples fixture for API testing, Error handling. OpenAPI/Swagger specs, GraphQL SDL, JSON Schema, paginated and problem+json error payloads, and webhook samples — for testing API clients, mock servers, contract tests, and schema validators.
Documented properties for this file: HEADERS · 142 bytes. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
Related files
- jsonOAuth Token Error — SAMPLESAMPLE OAuth error JSON for token-endpoint failure handling.
- jsonGraphQL Error Response (JSON)GraphQL error response with message and location — negative case for GraphQL clients.
- headersBrowser Security Headers Pack — SAMPLESAMPLE Permissions-Policy / Referrer-Policy / XCTO / XFO header pack.
- headersContent-Security-Policy Header — SAMPLESAMPLE CSP header line for CSP parsers and security-header scanners.
- headersCORS Response Headers — SAMPLESAMPLE CORS response header block as plain text for header parsers and policy tests.
- headersHSTS Header — SAMPLESAMPLE Strict-Transport-Security header for TLS policy scanners.
Generated by generation/security_wave_g.py. Free for any use, no attribution required — license.