Permissive CORS (ARCH2121)

Key python.security.permissive-cors · Severity warning · Category security · CWE CWE-942

Configuring CORS with a wildcard origin (*), especially with credentials, exposes the API to any site. Restrict origins to an explicit list.

Incorrect

from flask_cors import CORS

def init(app):
    CORS(app, origins="*", supports_credentials=True)

Correct

from flask_cors import CORS

def init(app):
    CORS(app, origins=["https://app.example.com"], supports_credentials=True)

Fix

Define an explicit list of trusted origins instead of a wildcard, and never combine * with credentials.