Cisco Switch SG350 - CORS header

[calexfiel]

The web server service running on this switch appears to create it's Access-Control-Allow-Origin response header based on the user-supplied Origin value. I am needing to  include the “Vary: Origin” header to prevent caching. The header indicates that the response is in some way dependent on the origin and should therefore not be served from cache for any other origin. 

Someone can help to fix it? 

[marce1000 · Accepted solution]

   - These parameters can not be changed on those devices , let alone on other cisco switches.

 M.

[calexfiel]

Thank you for your help.

[calexfiel]

Hi Marce, sorry for bother you, I have another question;

Based on result penetration test I have to disable all SSL export grade ciphers, to prevent 'SSL FREAK' (Factoring Attack on RSA-EXPORT Keys). Is it the same concept, or that is possible to set up in the Control Panel? 

[marce1000]

   - The only thing that you can do to mitigate such attacks is to use the latest firmware and then run the penetration test again (e.g.)

 M,

[Georg Pauwen]

Hello,

just out of curiosity, what is the 'Vary' value in the response header that you captured ? Is it a wildcard ('*') ?

[calexfiel]

Vary: Origin` will cause the user agent to fetch a response that includes `Access-Control-Allow-Origin`, rather than using the cached response from the previous non-CORS request that lacks `Access-Control-Allow-Origin`. So yes, should be a wildcard. I am not network professional.

Thank you so much again for your help