Permissive CORS (ARCH5121)

Key go.security.permissive-cors · Severity warning · Category security · CWE CWE-942

Setting Access-Control-Allow-Origin: *, especially alongside credentials, lets any website call the API and exfiltrate responses.

Incorrect

func handler(w http.ResponseWriter, r *http.Request) {
  w.Header().Set("Access-Control-Allow-Origin", "*")
  w.Header().Set("Access-Control-Allow-Credentials", "true")
  w.Write([]byte("ok"))
}

Correct

var allowed = map[string]bool{"https://app.example.com": true}

func handler(w http.ResponseWriter, r *http.Request) {
  origin := r.Header.Get("Origin")
  if allowed[origin] {
    w.Header().Set("Access-Control-Allow-Origin", origin)
    w.Header().Set("Access-Control-Allow-Credentials", "true")
  }
  w.Write([]byte("ok"))
}

Fix

Validate the Origin against an allowlist and reflect only trusted origins instead of a wildcard.