s0md3v/Corsy

Why is path dropped?

ecdeveloper opened this issue · 5 comments

ecdeveloper commented

I've been trying to run the script against URLs that look like https://example.com/foo/bar, and it looks like /foo/bar piece is being dropped, so we test only against the root domain - https://example.com. Any reason for doing that?

not-duckie commented

hey, test my fork of the tool and see if the problem still persists

ecdeveloper commented

I've actually fixed it locally by adding the parsed path to the url, but I was curious if it's a bug or intended behavior.

s0md3v commented

It is intended behavior. Do you guys want me to "fix" it?

ecdeveloper commented

Here's my thinking behind keeping the path. Sometimes various paths may have different CORS rules. More so, sometimes two different paths under the same hostname may point to different backends, so IMO it makes sense to scan all available paths.

s0md3v commented

This issue has been fixed now.