Permissive CORS (ARCH7121)

Key php.security.permissive-cors · Severity warning · Category security · CWE CWE-942

CORS configured with Access-Control-Allow-Origin: * lets any site call the API; combined with credentials it is rejected by the browser, but blindly reflecting the origin is abusable. Origins must be validated against an allowlist.

Incorrect

<?php
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Credentials: true');

Correct

<?php
$allowed = ['https://app.example.com', 'https://admin.example.com'];
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
if (in_array($origin, $allowed, true)) {
    header('Access-Control-Allow-Origin: ' . $origin);
    header('Access-Control-Allow-Credentials: true');
}

Fix

Validate the request origin against an allowlist instead of using a wildcard, and reflect only a matching origin.