Avoid unsafe CORS headers

문서 > Datadog 보안 > Code Security > Static Code Analysis (SAST) > SAST 규칙 > Avoid unsafe CORS headers

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

ID: php-security/unsafe-cors

Language: PHP

Severity: Error

Category: Security

CWE: 346

Description

The Cross-Origin Resource Sharing (CORS) mechanism allows many resources (such as fonts or JavaScript) on a web page to be requested from another domain outside the domain from which the resource originated. It’s a crucial feature, but it can also pose a significant security risk if not implemented properly.

This rule is important because it helps prevent potential security vulnerabilities. Specifically, it prevents the misuse of the Access-Control-Allow-Origin header. This header indicates which origins are allowed to read the response from the server. If the server sends back a response with the Access-Control-Allow-Origin: * header, this means it’s allowing all origins to access its resources, which is an unsafe practice.

To adhere to this rule and ensure good coding practices, always specify the exact origin that is allowed to access the resources. For example, instead of using header("Access-Control-Allow-Origin: *");, which allows all origins, use header("Access-Control-Allow-Origin: https://domain.tld");, which only allows the specified domain to access the resources. This ensures that only trusted domains have access to your server’s resources, thereby reducing the risk of cross-site request forgery (CSRF) or data leakage.

Non-Compliant Code Examples

<?php
// Insecure: Allowing all origins
header("Access-Control-Allow-Origin: *");

Compliant Code Examples

<?php
// Secure: Only allows specified origin
header("Access-Control-Allow-Origin: https://domain.tld");