Cors wildcard credentials

security.headers.cors_wildcard_credentials

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, response headers

What the rule checks

Scope. Applies to responses that carry Access-Control-Allow-Origin.

Expectation. Fails when Access-Control-Allow-Origin is `*` and Access-Control-Allow-Credentials is `true`: a contradictory configuration that signals an intent to share credentialed responses with any origin. Optional whitespace around values is not part of them (RFC 9110 §5.5). `*` without credentials and credentials for one named origin pass. Without Access-Control-Allow-Origin the check does not apply.

Source. Fetch Standard, 'CORS protocol and credentials' and 'CORS check' (`*` never matches a credentialed request)

Detection: analyze_security; needs network.

Failing example

The check reports a violation here. Corpus case cors_wildcard_credentials. The case is a set of response headers; there is no page.

Response headersHTTP

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Passing example

The check passes here and reports nothing. Corpus case cors_wildcard_without_credentials. The case is a set of response headers; there is no page.

Response headersHTTP

Access-Control-Allow-Origin: *
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.