Permissive CORS (ARCH4121)

Key java.security.permissive-cors · Severity warning · Category security · CWE CWE-942

CORS configured with a wildcard origin (*), especially combined with credentials, lets any website call your API using the user’s session.

Incorrect

@Bean
public CorsConfigurationSource cors() {
    CorsConfiguration c = new CorsConfiguration();
    c.addAllowedOrigin("*");
    c.setAllowCredentials(true);
    ...
}

Correct

@Bean
public CorsConfigurationSource cors() {
    CorsConfiguration c = new CorsConfiguration();
    c.setAllowedOrigins(List.of("https://app.example.com"));
    c.setAllowCredentials(true);
    ...
}

Fix

Restrict allowed origins to an explicit allowlist; never combine a wildcard origin with credentials.