Setting an overly permissive Cross-Origin Resource Sharing (CORS) policy allows malicious websites to read responses from your application on behalf of authenticated users.
Same-origin policy in browsers prevents JavaScript from
making cross-origin HTTP requests to resources with a different origin (domain, protocol, or port). The Cross-Origin Resource Sharing (CORS) mechanism allows servers to relax this
restriction by including Access-Control-Allow-Origin response headers that tell browsers which origins are permitted.
Setting the Access-Control-Allow-Origin header to a wildcard (*) or dynamically reflecting a user-supplied
Origin header without validation completely disables same-origin protection for the affected resource.
When CORS restrictions are disabled, a malicious website visited by an authenticated user can issue cross-origin requests to the vulnerable application and read the responses. This allows attackers to steal sensitive data accessible to the victim, such as account details, API keys, or private application data.
If the application is also configured with Access-Control-Allow-Credentials: true, the browser will include cookies and HTTP
authentication headers in cross-origin requests. Attackers can then perform authenticated operations on behalf of the victim, potentially leading to
full account takeover or unauthorized data modification.
Access-Control-Allow-Origin header should be set only for a trusted origin and for specific resources.Access-Control-Allow-Origin header. Prefer whitelisting domains over blacklisting or
allowing any domain (do not use * wildcard nor blindly return the Origin header content without any checks).
header("Access-Control-Allow-Origin: *"); // Noncompliant
header("Access-Control-Allow-Origin: $trusteddomain");
Access-Control-Allow-Origin header should be set only for a trusted origin and for specific resources.Access-Control-Allow-Origin header. Prefer whitelisting domains over blacklisting or
allowing any domain (do not use * wildcard nor blindly return the Origin header content without any checks).
response()->header('Access-Control-Allow-Origin', "*"); // Noncompliant
response()->header('Access-Control-Allow-Origin', $trusteddomain);
Access-Control-Allow-Origin header should be set only for a trusted origin and for specific resources.Access-Control-Allow-Origin header. Prefer whitelisting domains over blacklisting or
allowing any domain (do not use * wildcard nor blindly return the Origin header content without any checks).
use Symfony\Component\HttpFoundation\Response;
$response = new Response(
'Content',
Response::HTTP_OK,
['Access-Control-Allow-Origin' => '*'] // Noncompliant
);
$response->headers->set('Access-Control-Allow-Origin', '*'); // Noncompliant
User-controlled origin:
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpFoundation\Request;
$origin = $request->headers->get('Origin');
$response->headers->set('Access-Control-Allow-Origin', $origin); // Noncompliant
use Symfony\Component\HttpFoundation\Response;
$response = new Response(
'Content',
Response::HTTP_OK,
['Access-Control-Allow-Origin' => $trusteddomain]
);
$response->headers->set('Access-Control-Allow-Origin', $trusteddomain);
User-controlled origin validated with an allow-list:
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpFoundation\Request;
$origin = $request->headers->get('Origin');
if (in_array($origin, $trustedOrigins)) {
$response->headers->set('Access-Control-Allow-Origin', $origin);
}