'First check if the @allow_origin is set to the value we sent
(@origin) and if the allow_credentials is set to True. If this test
is successful (most important vulnerability) then do not check for
the @allow_origin is set to the value we sent.
:return: A list of vulnerability objects with the identified vulns
(if any).'

def _origin_echo(self, forged_req, url, origin, response, allow_origin, allow_credentials_str, allow_methods):

    if (allow_origin is None):
        return
    allow_origin = allow_origin.lower()
    allow_credentials = False
    if (allow_credentials_str is not None):
        allow_credentials = ('true' in allow_credentials_str.lower())
    if (origin not in allow_origin):
        return
    if allow_credentials:
        sev = severity.HIGH
        name = 'Insecure    Access-Control-Allow-Origin    with    credentials'
        msg = 'The    remote    Web    application,    specifically    "%s",    returned    a    "%s"    header    with    the    value    set    to    the    value    sent    in    the    request\'s    Origin    header    and    a    %s    header    with    the    value    set    to    "true",    which    is    insecure    and    leaves    the    application    open    to    Cross-domain    attacks    which    can    affect    logged-in    users.'
        msg = (msg % (forged_req.get_url(), ACCESS_CONTROL_ALLOW_ORIGIN, ACCESS_CONTROL_ALLOW_CREDENTIALS))
        v = Vuln(name, msg, sev, response.get_id(), self.get_name())
        v.set_url(forged_req.get_url())
        v[DOMAIN] = forged_req.get_url().get_domain()
        self.kb_append_uniq_group(self, 'cors_origin', v, group_klass=OriginEchoWithCredsInfoSet)
    else:
        sev = severity.LOW
        name = 'Insecure    Access-Control-Allow-Origin'
        msg = 'The    remote    Web    application,    specifically    "%s",    returned    a    "%s"    header    with    the    value    set    to    the    value    sent    in    the    request\'s    Origin    header,    which    is    insecure    and    leaves    the    application    open    to    Cross-domain    attacks.'
        msg = (msg % (forged_req.get_url(), ACCESS_CONTROL_ALLOW_ORIGIN))
        v = Vuln(name, msg, sev, response.get_id(), self.get_name())
        v.set_url(forged_req.get_url())
        v[DOMAIN] = forged_req.get_url().get_domain()
        self.kb_append_uniq_group(self, 'cors_origin', v, group_klass=OriginEchoInfoSet)
