CRITICAL
Rule Definition
Using the * as the value of the Access-Control-Allow-Origin header indicates that the application's data is accessible to JavaScript running on any domain.
Remediation
Do not mention "*", use specific domain.
For flask_cors, do not use send_wildcard=True when "origins" is "*".
Violation Code Sample
from flask import Flask
from flask_cors import CORS
app = Flask(__name__)
CORS(app, resources={r"/*": {"origins": "*", "send_wildcard": True}})
Fixed Code Sample
from flask import Flask
from flask_cors import CORS
app = Flask(__name__)
CORS(app, resources={r"/*": {"origins": "*", "send_wildcard": False}})
# or
# CORS(app, resources={r"/*": {"origins": ["server1.net", "server2.com"]}}) # use specific origins
Reference
OWASP Top 10 2017: A6-Security Misconfiguration
https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration
CWE-346: Origin Validation Error
https://cwe.mitre.org/data/definitions/346.html
Related Technologies
Technical Criterion
PCI-DSS4-Requirement-2.2.6 - System security parameters are configured to prevent misuse
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.