Post

🚨 CORS vulnerabilities in Go 🚨 Misusing strings.HasSuffix, Contains, or HasPrefix? You might be leaving the door wide open! 🔓 Learn how these patterns lead to bypasses 🐛👇 👉 pentesterlab.com/blog/golang-...

pentesterlab.comPentesterLab Blog: CORS Vulnerabilities in Go: Vulnerable Patterns and LessonsDive into common CORS vulnerabilities found in Go codebases, with real-world examples of flawed origin validation. Understand how these mistakes occur and why Go developers need robust solutions to se...

2/12/24, 9:50 pm9 reposts16 likes

jub0bs

@jub0bs.com

10 Dec 2024

At the end of the post, you mention a talk (entitled "What developers get for free") that you recently gave. Was this talk recorded and, if so, is the recording available online, by any chance? 👀

PentesterLab

@pentesterlab.com

11 Dec 2024

I think it was recorded but it's not available yet. It should be available on CHCon channel once they publish it: www.youtube.com/@CHConNZ/vid...

🙇🔖

Just use github.com/jub0bs/cors and sleep sound. 😉

github.comGitHub - jub0bs/cors: perhaps the best CORS middleware library for Goperhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

jub0bs

@jub0bs.com

6 Dec 2024

My library performs extensive configuration validation to prevent you from producing insecure CORS middleware. In particular, it supports only a limited number of origins patterns and alerts you to dangerous ones, such as httpx://*.com. go.dev/play/p/l0-9o...

go.devGo Playground - The Go Programming Language