Cross-origin policy accepts any origin
The CORS configuration accepts requests from any origin. Combined with credentials this lets any site a logged-in user visits make authenticated calls to the API and read the responses. Without credentials it may be intentional for a public API - the finding says which case it found.
medium likely application source OWASP A05:2021 / CWE-942
What it looks like
MEDIUM likely Cross-origin policy accepts any origin A05:2021
app/lib/cors.ts:7:3
5 │
6 │ export function applyOpenCors(response: NextResponse): NextResponse {
7 │ response.headers.set('Access-Control-Allow-Origin', '*')
│ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ accepts requests from any origin
8 │ response.headers.set('Access-Control-Allow-Credentials', 'true')
9 │ return response
From app/lib/cors.ts in the fixture suite.
The fixture test asserts this finding.
How to fix it
Replace the wildcard with the origins that actually need access, and only send credentials to those.
The fix for your framework
Choose the API used by your project.
- Next.js
- Nuxt
- NestJS
- Express
- Fastify
- Hono
- Koa
- Hapi
- Sails.js
- Astro
- Remix
- Gatsby
- SvelteKit
- TanStack Start
- SolidStart
- Elysia
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain cors-permissive
explain prints the rule and fixes in the terminal. It does not
use the network.