V5323. OWASP. Potentially tainted data is used to define 'Access-Control-Allow-Origin' header.

The analyzer has detected an insecure configuration of Cross-origin resource sharing (CORS). The Access-Control-Allow-Origin server response header value is generated based on unverified external data.

It is an insecure practice to configure the value of the Access-Control-Allow-Origin header based on unverified external data. Depending on the context, this can lead to varying levels of security risks. Attackers' websites can gain access to user's page resources, and under special circumstances, sensitive information could be exposed.

This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows:

• A5:2021-Security Misconfiguration.

The example of an insecure configuration:

@GetMapping("/test")
public ResponseEntity<?> getExample(@RequestParam("origin") String origin) {
  var httpHeaders = new HttpHeaders();
  httpHeaders.add("Access-Control-Allow-Origin", origin); // <=

  return new ResponseEntity<>("ok", httpHeaders, HttpStatus.ACCEPTED);
}

To mitigate these risks, ensure that external data is checked against the whitelisted values.

The fixed example:

private static final List<String> ALLOWED_ORIGINS = List.of(
        "https://first-allowed-domain.com",
        "https://second-allowed-domain.com"
);

@GetMapping("/test")
public ResponseEntity<?> getExample(@RequestParam("origin") String origin) {
  var httpHeaders = new HttpHeaders();
  if (ALLOWED_ORIGINS.contains(origin)) {
      httpHeaders.add("Access-Control-Allow-Origin", origin);
  }
  // ....
}

This diagnostic rule is classified as:

Was this page helpful?

Message submitted.

Your message has been sent. We will email you at

If you do not see the email in your inbox, please check if it is filtered to one of the following folders:

• Promotion
• Updates
• Spam

If you can’t find an answer to your question, fill in the form below and our developers will contact you

By clicking this button you agree to our Privacy Policy statement