CORS policy allows any origin together with credentials

ID

vbnet.misconfiguration.too_broad_cors_policy

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Misconfiguration

Language

VB.NET

Description

This CORS policy allows credentialed requests (AllowCredentials) from any origin (AllowAnyOrigin, or WithOrigins("*")). A browser forbids this exact combination for a reason: it lets any site issue authenticated cross-origin requests and read the responses, enabling cross-site data theft. Restrict the allowed origins to an explicit allow-list of trusted hosts via WithOrigins("https://trusted.example"), or drop AllowCredentials.

Rationale

This CORS policy allows credentialed requests (AllowCredentials) from any origin (AllowAnyOrigin, or WithOrigins("*")). A browser forbids this exact combination for a reason: it lets any site issue authenticated cross-origin requests and read the responses, enabling cross-site data theft. Restrict the allowed origins to an explicit allow-list of trusted hosts via WithOrigins("https://trusted.example"), or drop AllowCredentials.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub ConfigureChained(builder As CorsPolicyBuilder)
    ' VULNERABLE: CORS policy allows any origin together with credentials
    builder.AllowAnyOrigin().AllowCredentials()
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References