Fix cross-origin policy accepts any origin in NestJS

The CORS configuration accepts requests from any origin. Combined with credentials this lets any site a logged-in user visits make authenticated calls to the API and read the responses. Without credentials it may be intentional for a public API - the finding says which case it found.

medium likely NestJS CWE-942 / OWASP A05:2021

The vulnerable pattern in NestJS

HIGH likely Cross-origin policy accepts any origin A05:2021 src/main.ts:10:3 8 │ async function bootstrap() { 9 │ const app = await NestFactory.create(AppModule) 10 │ app.enableCors({ origin: true, credentials: true }) │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ accepts requests from any origin 11 │ await app.listen(3000) 12 │ }

This finding comes from the NestJS fixture in the owlwarden test suite. The response echoes the caller's origin and permits credentials, so any site a logged-in user visits can make authenticated requests to this API and read the replies. The browser's same-origin protection is switched off for every origin.

The corrected handler

Give enableCors an explicit origin list.

app.enableCors({
  origin: ['https://app.example.com'],
  credentials: true,
})

If you are not using NestJS

Replace the wildcard with the origins that actually need access, and only send credentials to those.

Check your own repository

npx owlwarden scan
npx owlwarden explain cors-permissive

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other NestJS checks

Rules with a tested NestJS example.

cors-permissive for every framework / All rules / owlwarden