CORS Null Origin
The API trusts the null origin — sent by sandboxed iframes.
Steps:
- Log in as Alice
- Visit /attacker — the sandboxed iframe reads your session data
- The flag appears when the CORS bypass succeeds
Hint: sandbox="allow-scripts" iframes get Origin: null