# Origin and host validation bypass

Loose origin, host, or scheme checks that accept attacker-controlled values via undefined, case, or trailing dots

_Area: Web access control and IDOR. Seen in 7 disclosed reports; 4 confirmed bounties, median $1,375, range $500-$18,834; latest 2023-08-18. Updated 2026-10-23._

## How it works
An access decision compares an origin, host, or URL scheme against an allowlist using a loose text comparison instead of strict equality on a normalized value. Three distinct failures recur: (1) the predicate returns a non-boolean, so a missing match yields `undefined` and slips past a `!== null` test [E3](https://bugbountylibrary.com/r/blog%3Ayxw21-github-io-2020-06-05-account-takeover-via-postmessage.md); (2) the two sides are normalized asymmetrically, so textually different but equivalent hosts (case, trailing root dot) compare unequal or a nil result is treated as allowed [E5](https://bugbountylibrary.com/r/h1%3A1374512.md)[E6](https://bugbountylibrary.com/r/blog%3Ahuntingreads-com-abusing-uri-parsers-for-fun-and-profit.md); (3) the scheme is never validated at all, so a dangerous URI is loaded [E2](https://bugbountylibrary.com/r/blog%3Apayatu-com-microsoft-edge-extensions-host-permission-bypass-cve-2019-0678.md). The broken assumption: "the string I compare" equals "the resource the browser or resolver will actually use."

## Where it shows up
- Origin checks using `filter(...)[0]` or `find(...)` compared with `!== null` [E3](https://bugbountylibrary.com/r/blog%3Ayxw21-github-io-2020-06-05-account-takeover-via-postmessage.md)
- Substring, regex, or wildcard host matching instead of exact host equality; shared multi-tenant origins like `storage.googleapis.com` or `*.google.com` [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2023-08-18-extensions.md)
- `postMessage` listeners checking only `event.source == window` or nothing at all [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2023-08-18-extensions.md)[E4](https://bugbountylibrary.com/r/bc%3Ae97730cc-7fc1-4e4a-9e14-e49802f58598.md)
- Asymmetric normalization: one input downcased, the sibling not; nil-returning parsers treated as allowed [E5](https://bugbountylibrary.com/r/h1%3A1374512.md)
- URL parsers used for security decisions without trailing-dot/case normalization [E6](https://bugbountylibrary.com/r/blog%3Ahuntingreads-com-abusing-uri-parsers-for-fun-and-profit.md)
- Navigation/load APIs that skip scheme validation, especially sibling methods [E2](https://bugbountylibrary.com/r/blog%3Apayatu-com-microsoft-edge-extensions-host-permission-bypass-cve-2019-0678.md)

## How to review
Find every place an origin, host, or scheme gates access. The invariant: the value used for the decision must be the same normalized value the consumer acts on, and the comparison must yield a strict boolean. Check that:
- Comparisons use exact equality on a parsed, normalized host (lowercased, trailing dot stripped) [E5](https://bugbountylibrary.com/r/h1%3A1374512.md)[E6](https://bugbountylibrary.com/r/blog%3Ahuntingreads-com-abusing-uri-parsers-for-fun-and-profit.md)
- Predicates cannot return undefined; grep for `filter`/`find` near `null` comparisons and require `=== expected` or a boolean cast [E3](https://bugbountylibrary.com/r/blog%3Ayxw21-github-io-2020-06-05-account-takeover-via-postmessage.md)
- Every message listener authenticates the sender via `event.origin` allowlist or a token, not `event.source` [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2023-08-18-extensions.md)[E4](https://bugbountylibrary.com/r/bc%3Ae97730cc-7fc1-4e4a-9e14-e49802f58598.md)
- Every navigation/load API validates the scheme against an allowlist, including sibling methods [E2](https://bugbountylibrary.com/r/blog%3Apayatu-com-microsoft-edge-extensions-host-permission-bypass-cve-2019-0678.md)

## Variants seen
- Non-boolean predicate: `filter()[0] !== null` accepts any origin via undefined [E3](https://bugbountylibrary.com/r/blog%3Ayxw21-github-io-2020-06-05-account-takeover-via-postmessage.md)
- Parser normalization gap: trailing-dot FQDN compares unequal to bare host [E6](https://bugbountylibrary.com/r/blog%3Ahuntingreads-com-abusing-uri-parsers-for-fun-and-profit.md)
- Asymmetric case handling: forwarded host not downcased, nil treated as allowed [E5](https://bugbountylibrary.com/r/h1%3A1374512.md)
- Missing scheme validation in one API while a sibling validates it [E2](https://bugbountylibrary.com/r/blog%3Apayatu-com-microsoft-edge-extensions-host-permission-bypass-cve-2019-0678.md)
- Trusting shared or wildcard origins in extension message surfaces [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2023-08-18-extensions.md)
- Sender check reduced to `event.source == window` [E4](https://bugbountylibrary.com/r/bc%3Ae97730cc-7fc1-4e4a-9e14-e49802f58598.md)

## Impact and severity
Led to account takeover and password change [E3](https://bugbountylibrary.com/r/blog%3Ayxw21-github-io-2020-06-05-account-takeover-via-postmessage.md), reading restricted local files [E6](https://bugbountylibrary.com/r/blog%3Ahuntingreads-com-abusing-uri-parsers-for-fun-and-profit.md), open redirects [E5](https://bugbountylibrary.com/r/h1%3A1374512.md), real-location leak [E4](https://bugbountylibrary.com/r/bc%3Ae97730cc-7fc1-4e4a-9e14-e49802f58598.md), and privileged extension API abuse [E1](https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2023-08-18-extensions.md). High severity because the bypass defeats the only access control; worse when accepted input flows into navigation or script execution.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2023-08-18-extensions.md
- E2: https://bugbountylibrary.com/r/blog%3Apayatu-com-microsoft-edge-extensions-host-permission-bypass-cve-2019-0678.md
- E3: https://bugbountylibrary.com/r/blog%3Ayxw21-github-io-2020-06-05-account-takeover-via-postmessage.md
- E4: https://bugbountylibrary.com/r/bc%3Ae97730cc-7fc1-4e4a-9e14-e49802f58598.md
- E5: https://bugbountylibrary.com/r/h1%3A1374512.md
- E6: https://bugbountylibrary.com/r/blog%3Ahuntingreads-com-abusing-uri-parsers-for-fun-and-profit.md