HIGH AI PREVALENCE: HIGH auth.csharp.cors.reflect-any-origin-credentials

A CORS policy combines credentialed requests with a wildcard or reflected origin (`AllowCredentials()` together with `AllowAnyOrigin()` or `SetIsOriginAllowed(...)` that returns true for everything).

CWE-942 OWASP API8:2023 C#

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This lets any website make cross-origin requests carrying the user's cookies and read the response, which is a cross-site data-theft and CSRF primitive (CWE-942). This is a common AI-generated mistake made to "just make CORS work".

Never pair AllowCredentials() with a wildcard/reflected origin. Pin an explicit allow-list with WithOrigins("https://app.example.com") and only then call AllowCredentials().

VULNERABLE

vulnerable.cs

using Microsoft.AspNetCore.Cors.Infrastructure;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddCors(options =>
        {
            options.AddPolicy("reflectAllowed", builder =>
            {
                // ruleid: auth.csharp.cors.reflect-any-origin-credentials
                builder.SetIsOriginAllowed(origin => true).AllowCredentials();
            });

            options.AddPolicy("credentialsReflect", builder =>
            {
                // ruleid: auth.csharp.cors.reflect-any-origin-credentials
                builder.AllowCredentials().SetIsOriginAllowed(origin => true);
            });

            options.AddPolicy("anyOrigin", builder =>
            {
                // ruleid: auth.csharp.cors.reflect-any-origin-credentials
                builder.AllowAnyOrigin().AllowCredentials();
            });

            options.AddPolicy("credentialsAny", builder =>
            {
                // ruleid: auth.csharp.cors.reflect-any-origin-credentials
                builder.AllowCredentials().AllowAnyOrigin();
            });
        });
    }
}

SAFE

safe.cs

using Microsoft.AspNetCore.Cors.Infrastructure;
using Microsoft.Extensions.DependencyInjection;

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddCors(options =>
        {
            options.AddPolicy("trusted", builder =>
            {
                builder
                    .WithOrigins("https://app.example.com")
                    .AllowCredentials();
            });

            options.AddPolicy("publicReadOnly", builder =>
            {
                builder.AllowAnyOrigin();
            });
        });
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.cors.reflect-any-origin-credentials -- <reason>

References

https://learn.microsoft.com/aspnet/core/security/cors ↗https://cwe.mitre.org/data/definitions/942.html ↗

A CORS policy combines credentialed requests with a wildcard or reflected origin (AllowCredentials() together with AllowAnyOrigin() or SetIsOriginAllowed(...) that returns true for everything).

Why this matters

Suppressing this rule

References

A CORS policy combines credentialed requests with a wildcard or reflected origin (`AllowCredentials()` together with `AllowAnyOrigin()` or `SetIsOriginAllowed(...)` that returns true for everything).