open-cors-anti-pattern

To check if your CORS configuration is vulnerable to CWE-942, analyze server configurations and code setting CORS headers to identify overly permissive wildcard (`*`), null, or reflected origin values. Ensure Access-Control-Allow-Origin is not reflecting untrusted client origins.

Using a wildcard Access-Control-Allow-Origin header exposes sensitive data and allows unauthorized actions by malicious websites. It creates an overly permissive Cross-Origin Resource Sharing policy that bypasses strict domain allowlists.

To prevent reflected Origin headers in API security, review API response headers to ensure Access-Control-Allow-Origin is not reflecting an untrusted client origin. Implement strict allowlists for trusted domains instead of dynamic reflection.

Setting Access-Control-Allow-Origin to null exposes your web application to security risks because it can allow unauthorized cross-origin requests. You should reject null values and enforce strict allowlists for trusted domains only.

The best way to implement secure CORS policies for an API is to use strict allowlists for trusted origins. This mitigates CWE-942 by ensuring the Access-Control-Allow-Origin header never accepts wildcard or reflected untrusted values.