Permissive CORS configuration

A server can use CORS (Cross-Origin Resource Sharing) to relax the restrictions imposed by the Same-Origin Policy, allowing controlled, secure cross-origin requests when necessary.

A server with an overly permissive CORS configuration may inadvertently expose sensitive data or enable CSRF attacks, which allow attackers to trick users into performing unwanted operations on websites they're authenticated to.

Recommendation

When the origin is set to true, the server accepts requests from any origin, potentially exposing the system to CSRF attacks. Use false as the origin value or implement a whitelist of allowed origins instead.

When the origin is set to null, it can be exploited by an attacker who can deceive a user into making requests from a null origin, often hosted within a sandboxed iframe.

If the origin value is user-controlled, ensure that the data is properly sanitized and validated against a whitelist of allowed origins.

Example

In the following example, server_1 accepts requests from any origin because the value of origin is set to true. server_2 uses user-controlled data for the origin without validation.

import { ApolloServer } from 'apollo-server';
var https = require('https'),
    url = require('url');

var server = https.createServer(function () { });

server.on('request', function (req, res) {
    // BAD: origin is too permissive
    const server_1 = new ApolloServer({
        cors: { origin: true }
    });

    let user_origin = url.parse(req.url, true).query.origin;
    // BAD: CORS is controlled by user
    const server_2 = new ApolloServer({
        cors: { origin: user_origin }
    });
});

To fix these issues, server_1 uses a restrictive CORS configuration that is not vulnerable to CSRF attacks. server_2 properly validates user-controlled data against a whitelist before using it.

import { ApolloServer } from 'apollo-server';
var https = require('https'),
    url = require('url');

var server = https.createServer(function () { });

server.on('request', function (req, res) {
    // GOOD: origin is restrictive
    const server_1 = new ApolloServer({
        cors: { origin: false }
    });

    let user_origin = url.parse(req.url, true).query.origin;
    // GOOD: user data is properly sanitized
    const server_2 = new ApolloServer({
        cors: { origin: (user_origin === "https://allowed1.com" || user_origin === "https://allowed2.com") ? user_origin : false }
    });
});

References

• Mozilla Developer Network: CORS, Access-Control-Allow-Origin.
• W3C: CORS for developers, Advice for Resource Owners.
• Common Weakness Enumeration: CWE-942.