Kiwi.com CORS + Booking Data Access PoC

This demonstrates that https://booking-api.skypicker.com reflects arbitrary origins and allows reading sensitive booking data.

1. Booking Thank-You Endpoint

Requesting: https://booking-api.skypicker.com/mmb/v1/bff/web/bookings/841648775/thank_you

Loading...

2. Payment Endpoint

Requesting: https://booking-api.skypicker.com/payments/v1/paylib/order/.../payment?booking_id=841648775

Loading...