open-cors-anti-pattern

What this skill does

# Open CORS Policy Anti-Pattern

**Severity:** Medium

## Summary

Misconfigured CORS policies allow any website to make authenticated requests on behalf of users. Servers responding with `Access-Control-Allow-Origin: *` or reflecting client `Origin` headers enable data theft and unauthorized actions.

## The Anti-Pattern

The anti-pattern is overly permissive `Access-Control-Allow-Origin` headers: wildcard (`*`) or reflecting client `Origin` values.

### BAD Code Example

```python
# VULNERABLE: The server reflects any Origin header, or uses a wildcard with credentials.
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.after_request
def add_cors_headers(response):
    # DANGEROUS: Reflecting Origin header.
    # Attacker site (https://evil.com) can make requests.
    origin = request.headers.get('Origin')
    if origin:
        response.headers['Access-Control-Allow-Origin'] = origin

    # DANGEROUS: Wildcard with credentials.
    # Most browsers block, but critical misconfiguration.
    # response.headers['Access-Control-Allow-Origin'] = '*'
    # response.headers['Access-Control-Allow-Credentials'] = 'true'

    return response

@app.route("/api/user/profile")
def get_profile():
    # Endpoint for frontend, relies on session cookie.
    user = get_user_from_session()
    return jsonify(user.to_dict())

# Attack:
# 1. Logged-in user visits https://evil.com
# 2. Script fetches https://yourapp.com/api/user/profile
# 3. Permissive CORS allows request with session cookie
# 4. Server responds with user's sensitive profile
# 5. evil.com exfiltrates user data
```

### GOOD Code Example

```python
# SECURE: Maintain a strict allowlist of trusted origins.
from flask import Flask, request, jsonify

app = Flask(__name__)

# Strict allowlist of permitted origins.
ALLOWED_ORIGINS = {
    "https://www.yourapp.com",
    "https://yourapp.com",
    "https://staging.yourapp.com"
}

@app.after_request
def add_secure_cors_headers(response):
    origin = request.headers.get('Origin')
    if origin in ALLOWED_ORIGINS:
        # Set header only if origin in trusted list.
        response.headers['Access-Control-Allow-Origin'] = origin
        response.headers['Access-Control-Allow-Credentials'] = 'true'
        # Vary tells caches response depends on Origin.
        response.headers['Vary'] = 'Origin'
    return response

@app.route("/api/user/profile")
def get_profile_secure():
    user = get_user_from_session()
    return jsonify(user.to_dict())

# Script from https://evil.com: origin not in ALLOWED_ORIGINS,
# no CORS headers sent. Browser same-origin policy blocks request.
```

## Detection

- **Use browser developer tools:** Open the "Network" tab, make a cross-origin request to your API, and inspect the response headers. Look for `Access-Control-Allow-Origin`. Is it `*`? Does it match the `Origin` of your request even if that origin is untrusted?
- **Use `curl`:** Make a request and set a custom `Origin` header to see if the server reflects it:
  `curl -H "Origin: https://evil.com" -I https://yourapp.com/api/some-endpoint`
  Check if the response contains `Access-Control-Allow-Origin: https://evil.com`.
- **Review CORS configuration:** Check your application's code or framework configuration for how CORS headers are being set. Look for wildcards or reflected origins.

## Prevention

- [ ] **Maintain strict allowlist:** Most critical step. Define trusted origins explicitly.
- [ ] **Never reflect `Origin` header:** Validate against allowlist before reflecting.
- [ ] **Avoid wildcard on authenticated endpoints:** `*` unsafe for endpoints using cookies or `Authorization` headers. Only use for public, unauthenticated resources.
- [ ] **Use `Access-Control-Allow-Credentials` carefully:** Set to `true` only when necessary and only for allowlisted origins.
- [ ] **Add `Vary: Origin` header:** Tells caches response depends on Origin. Prevents cached response for trusted origin being served to malicious one.

## Related Security Patterns & Anti-Patterns

- [Missing Security Headers Anti-Pattern](../missing-security-headers/): CORS is a key part of the broader suite of security headers an application must manage.
- [Cross-Site Scripting (XSS) Anti-Pattern](../xss/): An attacker could use a permissive CORS policy to exfiltrate data stolen via an XSS attack.

## References

- [OWASP Top 10 A02:2025 - Security Misconfiguration](https://owasp.org/Top10/2025/A02_2025-Security_Misconfiguration/)
- [OWASP GenAI LLM07:2025 - System Prompt Leakage](https://genai.owasp.org/llmrisk/llm07-system-prompt-leakage/)
- [OWASP API Security API8:2023 - Security Misconfiguration](https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/)
- [OWASP CORS Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Origin_Resource_Sharing_Cheat_Sheet.html)
- [CWE-942: Permissive Cross-domain Policy with Untrusted Domains](https://cwe.mitre.org/data/definitions/942.html)
- [PortSwigger - CORS Vulnerabilities](https://portswigger.net/web-security/cors)
- Source: [sec-context](https://github.com/Arcanum-Sec/sec-context)