CRITICAL: CORS allows wildcard origin with credentials - browser rejects

[poyrazK]

Why is this an issue?

In pkg/httputil/middleware.go:77,81, CORS allows Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true. This combination is insecure and browsers ignore the wildcard when credentials are present.

What is causing it?

c.Header("Access-Control-Allow-Origin", "*")
c.Header("Access-Control-Allow-Credentials", "true")

How can it be solved?

Either:

• Set specific origin: c.Header("Access-Control-Allow-Origin", c.Request.Host)
• Or don't allow credentials with wildcard origin

Category

• Small
• Medium
• Large

Severity

• Low
• Medium
• High
• Critical