Comments (6)
Hi Olivier, thanks for your reply.
Yeah, setting credentials to false by default can reduce misconfigurations, but the point I want to say here is that, converting Origin: *
and Credentials: true
to origin reflection is insecure and incompatible with CORS standards.
Current CORS standards(both W3C CORS and WHATWG fetch standard) have a clear definition for the wildcard *
, which means any domain is allowed. But they also have another important security requirement: Origin: *
and Credentials: true
cannot be used at the same time, to avoid overly loose permissions. Currently all browsers follow this requirement to disallow this configuration combination.
If a framework actively converts *
to reflect any origin header value, it means Origin: *
and Credentials: true
can be used at the same time. This behavior leads to CORS protocol's security design to be bypassed, causing many misconfiguration security problems.
Therefore, I suggest frameworks to follow the standard definition of *
. When a user configures Origin:*
, frameworks just directly returns Access-control-Allow-Access: *
. When a user configures both Origin:*
and Credentials: true
, frameworks should warn users that this is a misconfiguration because browsers will not accept this combination.
from cors.
This is only the case when allow credential is enabled, which is not the default. What change would you expect?
from cors.
FYI, here are some more similar issues:
Yii2 framework, yiisoft/yii2#16193
Tomcat CORSFilter, CVE-2018-8014, https://bz.apache.org/bugzilla/show_bug.cgi?id=62343
from cors.
Please see #56
from cors.
@chenjj any feedback?
from cors.
Looks good, thanks!
from cors.
Related Issues (20)
- gocover.io has shut down HOT 1
- gin wrapper default status HOT 1
- Listing Origin as an allowed request header is unnecessary HOT 4
- No way to disable caching of preflight responses HOT 1
- Access-Control-Expose-Headers should be sent in preflight response HOT 2
- AllowOriginRequestFunc considered harmful (may lead to Web cache poisoning) HOT 2
- Allowing methods that are not uppercase should be possible but isn't HOT 5
- Unexpected `Access-Control-Expose-Headers` header behavior HOT 2
- [Feature Request] AllowCredentialsFunc: boolean, HOT 2
- Middleware benchmarks are still skewed (follow-up to #156)
- AllowedOrigins doesn't block unlisted origins HOT 2
- .
- Some malicious/spoofed preflight requests cause prohibitive load HOT 3
- cors not adding multiple Access-Control-Allow-Origin entries HOT 2
- failing local test since v1.11.0 HOT 3
- Case-sensitive look up on allowed headers map HOT 4
- Arbitrary origin allowed in CORS header HOT 1
- Wildcard support for AllowedHeaders or add AllowedHeadersFunc HOT 1
- v1.11.0 version forces all headers to be lowercase
- AllowOriginVaryRequestFunc support for adding values to request context HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cors.