HIGH AI PREVALENCE: MEDIUM auth.rust.cors.permissive

A wide-open CORS policy is configured.

CWE-942 OWASP API8:2023 rust

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Cors::permissive() (actix-web), CorsLayer::permissive() / CorsLayer::very_permissive() (tower-http), and CorsLayer::new().allow_origin(Any) all allow requests from any origin. Combined with credentialed requests this lets any website read authenticated responses, including OAuth/OIDC tokens, session data, and user info exposed by your API.

Restrict CORS to an explicit allowlist of trusted origins instead, e.g. allow_origin("https://app.example.com".parse().unwrap()) or allow_origin(["https://app.example.com".parse().unwrap()]).

VULNERABLE

vulnerable.rs

use actix_cors::Cors;
use tower_http::cors::{Any, CorsLayer};

// actix-web: fully permissive CORS.
fn actix_cors() -> Cors {
    // ruleid: auth.rust.cors.permissive
    Cors::permissive()
}

// tower-http: permissive layer allows any origin, method, and header.
fn tower_permissive() -> CorsLayer {
    // ruleid: auth.rust.cors.permissive
    CorsLayer::permissive()
}

// tower-http: explicit wide-open origin.
fn tower_any_origin() -> CorsLayer {
    // ruleid: auth.rust.cors.permissive
    CorsLayer::new().allow_origin(Any)
}

SAFE

safe.rs

use actix_cors::Cors;
use tower_http::cors::CorsLayer;

// ok: auth.rust.cors.permissive -- actix: explicit trusted origin allowlist
fn actix_allowlist() -> Cors {
    Cors::default()
        .allowed_origin("https://app.example.com")
        .allowed_origin("https://admin.example.com")
}

// ok: auth.rust.cors.permissive -- tower-http: single explicit origin
fn tower_single_origin() -> CorsLayer {
    CorsLayer::new().allow_origin("https://app.example.com".parse().unwrap())
}

// ok: auth.rust.cors.permissive -- tower-http: explicit list of origins
fn tower_origin_list() -> CorsLayer {
    CorsLayer::new().allow_origin([
        "https://app.example.com".parse().unwrap(),
        "https://admin.example.com".parse().unwrap(),
    ])
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.rust.cors.permissive -- <reason>

References

https://docs.rs/actix-cors/latest/actix_cors/struct.Cors.html#method.permissive ↗https://docs.rs/tower-http/latest/tower_http/cors/struct.CorsLayer.html ↗https://cwe.mitre.org/data/definitions/942.html ↗