Permissive CORS (ARCH323)

Ce contenu n’est pas encore disponible dans votre langue.

Key dotnet.security.permissive-cors · Severity error · Category security · CWE CWE-942

When AllowAnyOrigin is combined with AllowCredentials, any origin can make requests with credentials (cookies/tokens). This exposes user sessions to malicious sites.

Incorrect

builder.Services.AddCors(o => o.AddDefaultPolicy(p =>
    p.AllowAnyOrigin()
     .AllowAnyHeader()
     .AllowCredentials()));

Correct

builder.Services.AddCors(o => o.AddDefaultPolicy(p =>
    p.WithOrigins("https://app.example.com")
     .AllowAnyHeader()
     .AllowCredentials()));

Fix

When credentials are required, replace AllowAnyOrigin with WithOrigins and explicitly list trusted origins.