Fix cross-origin policy accepts any origin in Next.js
The CORS configuration accepts requests from any origin. Combined with credentials this lets any site a logged-in user visits make authenticated calls to the API and read the responses. Without credentials it may be intentional for a public API - the finding says which case it found.
medium likely Next.js CWE-942 / OWASP A05:2021
The vulnerable pattern in Next.js
This finding comes from the Next.js fixture in the owlwarden test suite. Any origin may call this API and read the response. That is a deliberate choice for a public endpoint and a mistake for anything behind a session - nothing in the source says which this is, so it is reported for you to decide.
The corrected handler
Return an explicit origin from the route or middleware, not '*'.
const allowed = new Set(['https://app.example.com'])
const origin = request.headers.get('origin') ?? ''
if (allowed.has(origin)) {
response.headers.set('Access-Control-Allow-Origin', origin)
response.headers.set('Vary', 'Origin')
}If you are not using Next.js
Replace the wildcard with the origins that actually need access, and only send credentials to those.
Check your own repository
npx owlwarden scan
npx owlwarden explain cors-permissiveRuns on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.
Other Next.js checks
Rules with a tested Next.js example.
- hardcoded-secret high Credential hardcoded in source
- insecure-cookie medium Cookie set without its protective attributes
- install-lifecycle-script medium Package declares an install-time script
- open-redirect medium Redirect target comes from the caller
- sensitive-data-logged medium Sensitive data written to a log
- sql-injection high SQL query built by string interpolation
- ssrf high Server fetches a URL the caller controls
- stack-trace-leak high Stack trace leaked in error response
- weak-crypto high Broken cryptographic primitive protecting a secret