Permissive CORS (ARCH8121)

Key kotlin.security.permissive-cors · Severity warning · Category security · CWE CWE-942

Flags CORS configured with allowedOrigins("*") / anyHost() / allowedOriginPatterns("*"), especially together with credentials.

Incorrect

registry.addMapping("/**").allowedOrigins("*").allowCredentials(true)

Correct

registry.addMapping("/**").allowedOrigins("https://app.example.com")

Fix

List the exact origins; never combine a wildcard with credentials.