Permissive CORS (ARCH8121)
Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.
Key kotlin.security.permissive-cors · Severity warning · Category security · CWE CWE-942
Flags CORS configured with allowedOrigins("*") / anyHost() / allowedOriginPatterns("*"), especially together with credentials.
Incorrect
Section titled “Incorrect”registry.addMapping("/**").allowedOrigins("*").allowCredentials(true)Correct
Section titled “Correct”registry.addMapping("/**").allowedOrigins("https://app.example.com")List the exact origins; never combine a wildcard with credentials.