CORS (Cross-Origin Resource Sharing) defines a mechanism to enable client-side crossorigin requests. This application is using CORS in an insecure way.
The web application fails to properly validate the Origin header (check Details section for more information) and returns the header Access-Control-Allow-Credentials: true. In this configuration any website can issue requests made with user credentials and read the responses to these requests. Trusting arbitrary origins effectively disables the sameorigin policy, allowing two-way interaction by third-party web sites.
Recommendations Allow only selected, trusted domains in the Access-Control-Allow-Origin header.
Someone know how to mitigate it?
I try to add in virtual proxy the sentence ACCESS CONTROL ORIGIN, in the response headers QMC , but still continue
