Permissive CORS (ARCH6121)

Key ruby.security.permissive-cors · Severity warning · Category security · CWE CWE-942

Configuring CORS with a wildcard origin (*), especially combined with credentials, exposes the API to being read by any site.

Incorrect

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins "*"
    resource "*", credentials: true, headers: :any
  end
end

Correct

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins "https://app.example.com"
    resource "*", credentials: true, headers: :any
  end
end

Fix

Restrict allowed origins to an explicit list; never use a wildcard origin together with credentials.