CORS closed

Verifies

Every CORS configuration allows only declared origins and never combines a wildcard or reflected origin with credentials.

Inputs

Non-test code files (JavaScript, TypeScript, Python, PHP) plus config/cors.php, vercel.json, next.config, nginx configuration, Django settings and serverless/CloudFormation templates. Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.

Decision rule

Not applicable when the checkout has neither server-side code nor CORS configuration. FAIL (HIGH) when a wildcard or reflected origin is combined with credentials (cors origin '*' or true with credentials: true; Access-Control-Allow-Origin '*' or echoing the request Origin with Allow-Credentials true; CORS_ALLOW_ALL_ORIGINS with CORS_ALLOW_CREDENTIALS; CORSMiddleware allow_origins ['*'] with allow_credentials; Laravel allowed_origins ['*'] with supports_credentials). A wildcard or reflected origin without credentials, and an unconfigured cors()/CORS(app)/enableCors() (library default '*'), are MEDIUM and block only inside Extended suites. PASS when every configuration site lists declared origins, or when server code exists with no CORS configuration at all (browser same-origin default).

Type

deterministic

1.0.3: credentials for a manual `Access-Control-Allow-Origin` header used to be read against the WHOLE file: a helper with two independent `if`/`else` branches — one returning a bare wildcard with no credentials, the other a validated origin WITH credentials — had its wildcard branch reported HIGH just because the word appeared elsewhere in the file. `credentials` (and the existing `reflected` look-back window) is now read from the enclosing `{...}` block the header write itself belongs to (a brace-balanced walk outward, capped, falling back to a bounded window when the header sits outside any braces at all — sequential `header()` calls in PHP/nginx), so two branches that never execute together are judged separately. A wildcard and credentials written into the SAME object or the same function body still fail (planted case: `res.writeHead(200, { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Credentials': 'true' })` stays HIGH). (1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative; every model call stays under the engine prompt cap (spec.promptMaxChars = AUDITOR_AI_PROMPT_MAX_CHARS): assess mode sends the candidate set in parts and aggregates the verdicts (a HIGH in any part is a FAIL, an unsatisfied part is a FAIL).))

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.