Want everyone on your software team to learn this? Get completion tracking and compliance reporting with Hacksplaining for Teams. Free 14-day trial.
Data Exfiltration Monitor
SecureBank's API receives the cross-origin request. Because the CORS configuration reflects any origin while allowing credentials, the browser permits the response -- and the API hands back Vic's sensitive account data.