Skip to content

Origin validation error

Description

Access-Control-Allow-Origin response header is set to *. This will disable CORS Same Origin Policy restrictions.

Examples

Insecure Code

javascript
app.options('*', cors())

Secure Code

javascript
app.options('https://example.com', cors())

Remediation

Set the Access-Control-Allow-Origin response header to a specific domain or a list of trusted domains instead of *.

Rule Details

FieldValue
IDCODE-0396
CategoryWeb
SeverityMEDIUM
CWECWE-346
ConfidenceHIGH
ImpactMEDIUM
LikelihoodMEDIUM
ExploitabilityEASY
TagsCORS, Security Misconfiguration
OWASPA6:2017-Security Misconfiguration, A05:2021-Security Misconfiguration