Contents
V5325. OWASP. Setting the value of the 'Access-Control-Allow-Origin' header to '*' is potentially insecure.
The analyzer has detected an insecure Cross-origin resource sharing (CORS) configuration. The * value of the Access-Control-Allow-Origin server response header allows any web page to access the content of responses from any host.
If the value of the Access-Control-Allow-Origin header is *, web pages with any domain can retrieve the response contents. This is an insecure practice that can lead to varying levels of security risks, depending on the context. Attacker websites can gain access to your page resources, and in some cases, sensitive information could be exposed.
This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows:
Examples of insecure configurations:
@CrossOrigin // <=
@GetMapping("/user")
public User getUser(....) {
// ....
}@CrossOrigin(origins = "*") // <=
@GetMapping("/user")
public User getUser(....) {
// ....
}The fixed code:
@CrossOrigin(origins = "https://allowed.com") // <=
@GetMapping("/getUser")
public User getUser(....) {
// ....
}This diagnostic is classified as:
Was this page helpful?
