The service may be configured with a cross-origin resource sharing (CORS) policy on a bucket that determines which web origins a browser is permitted to request objects from.
Cross-Origin Resource Sharing
CCC.ObjStor.CP15
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.ObjStor.TH07 | Cross-Origin Requests are Permitted from Untrusted Origins | A bucket's cross-origin resource sharing policy may be configured with a wildcard or overly broad list of allowed origins, methods, or headers. Scripts served from an untrusted web origin can then read or write objects from within an authenticated user's browser session. This results in a loss of confidentiality or integrity of objects in the bucket. |