Permissive CORS (ARCH9121)
Ce contenu n’est pas encore disponible dans votre langue.
Key swift.security.permissive-cors · Severity warning · Category security · CWE CWE-942
Flags CORSMiddleware configured with allowedOrigin: .all, especially together with allowCredentials.
Incorrect
Section titled “Incorrect”CORSMiddleware.Configuration(allowedOrigin: .all, ...)Correct
Section titled “Correct”CORSMiddleware.Configuration(allowedOrigin: .custom("https://app.example.com"), ...)List the exact origins; never combine .all with credentials.