Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return; | ||
| } | ||
| if (req.method === 'OPTIONS') { | ||
| res.setHeader('Access-Control-Allow-Origin', origin); |
Check failure
Code scanning / CodeQL
CORS misconfiguration for credentials transfer
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the issue, the Access-Control-Allow-Origin header must only be set to trusted origins. This can be achieved by validating the origin header against a whitelist of allowed origins before setting it. If the origin is not in the whitelist, the header should not be set, and the request should be rejected.
Steps to fix:
- Introduce a whitelist of allowed origins.
- Validate the
originheader against the whitelist before setting theAccess-Control-Allow-Originheader. - Ensure that the validation logic applies to all request types, including
OPTIONSpreflight requests.
Required changes:
- Add a whitelist of allowed origins.
- Update the
autoAuthfunction to validate theoriginheader against the whitelist before setting theAccess-Control-Allow-Originheader.
| @@ -221,3 +221,3 @@ | ||
|
|
||
| const ALLOWED_ORIGIN = 'https://account.phcode.io'; | ||
| const ALLOWED_ORIGINS = ['https://account.phcode.io']; | ||
| function autoAuth(req, res) { | ||
| @@ -226,4 +226,4 @@ | ||
| // dev builds. | ||
| const isAllowedOrigin = !origin || (ALLOWED_ORIGIN === origin); | ||
| if(!isAllowedOrigin){ | ||
| const isAllowedOrigin = origin && ALLOWED_ORIGINS.includes(origin); | ||
| if (!isAllowedOrigin) { | ||
| res.writeHead(403, { 'Content-Type': 'text/plain' }); |
| const cleanPath = url.pathname.replace(PHOENIX_AUTO_AUTH_URL, ''); | ||
| // Check if the request is for the autoVerifyCode endpoint | ||
| if (cleanPath === `/autoVerifyCode` && req.method === 'GET') { | ||
| origin && res.setHeader('Access-Control-Allow-Origin', origin); |
Check failure
Code scanning / CodeQL
CORS misconfiguration for credentials transfer
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the issue, we will implement a whitelist of allowed origins and validate the req.headers.origin against this whitelist before setting the Access-Control-Allow-Origin header. This ensures that only trusted origins are allowed, and prevents attackers from exploiting the dynamic computation of the header.
Steps to fix:
- Define a whitelist of allowed origins as a constant.
- Validate the
req.headers.originagainst the whitelist. - Set the
Access-Control-Allow-Originheader only if the origin is in the whitelist. - Remove redundant checks and ensure consistent validation logic.
| @@ -221,3 +221,3 @@ | ||
|
|
||
| const ALLOWED_ORIGIN = 'https://account.phcode.io'; | ||
| const ALLOWED_ORIGINS = ['https://account.phcode.io']; | ||
| function autoAuth(req, res) { | ||
| @@ -226,4 +226,4 @@ | ||
| // dev builds. | ||
| const isAllowedOrigin = !origin || (ALLOWED_ORIGIN === origin); | ||
| if(!isAllowedOrigin){ | ||
| const isAllowedOrigin = ALLOWED_ORIGINS.includes(origin); | ||
| if (!isAllowedOrigin) { | ||
| res.writeHead(403, { 'Content-Type': 'text/plain' }); | ||
| @@ -247,4 +247,4 @@ | ||
| if (cleanPath === `/autoVerifyCode` && req.method === 'GET') { | ||
| origin && res.setHeader('Access-Control-Allow-Origin', origin); | ||
| if(!verificationCode) { | ||
| res.setHeader('Access-Control-Allow-Origin', origin); | ||
| if (!verificationCode) { | ||
| res.setHeader('Content-Type', 'text/plain'); | ||
| @@ -261,3 +261,3 @@ | ||
| nodeConnector.triggerPeer(EVENT_CONNECTED, "ok"); | ||
| origin && res.setHeader('Access-Control-Allow-Origin', origin); | ||
| res.setHeader('Access-Control-Allow-Origin', origin); | ||
| res.setHeader('Access-Control-Allow-Credentials', 'true'); |
| verificationCode = null; // verification code is only returned once | ||
| } else if (cleanPath === `/appVerified` && req.method === 'GET') { | ||
| nodeConnector.triggerPeer(EVENT_CONNECTED, "ok"); | ||
| origin && res.setHeader('Access-Control-Allow-Origin', origin); |
Check failure
Code scanning / CodeQL
CORS misconfiguration for credentials transfer
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the issue, we need to ensure that the Access-Control-Allow-Origin header is set to a safe and validated value. This can be achieved by using a whitelist of allowed origins and ensuring that the origin header is explicitly validated against this whitelist before being used. Additionally, we should handle edge cases like the null origin to prevent misuse.
Steps to fix:
- Introduce a whitelist of allowed origins, including
ALLOWED_ORIGIN. - Validate the
originheader against the whitelist before setting theAccess-Control-Allow-Originheader. - Reject requests with invalid or unsafe origins, including the
nullorigin. - Update the logic in the
autoAuthfunction to use the validated origin.
| @@ -221,3 +221,3 @@ | ||
|
|
||
| const ALLOWED_ORIGIN = 'https://account.phcode.io'; | ||
| const ALLOWED_ORIGINS = ['https://account.phcode.io']; | ||
| function autoAuth(req, res) { | ||
| @@ -226,4 +226,4 @@ | ||
| // dev builds. | ||
| const isAllowedOrigin = !origin || (ALLOWED_ORIGIN === origin); | ||
| if(!isAllowedOrigin){ | ||
| const isAllowedOrigin = origin && ALLOWED_ORIGINS.includes(origin); | ||
| if (!isAllowedOrigin || origin === 'null') { | ||
| res.writeHead(403, { 'Content-Type': 'text/plain' }); | ||
| @@ -247,3 +247,3 @@ | ||
| if (cleanPath === `/autoVerifyCode` && req.method === 'GET') { | ||
| origin && res.setHeader('Access-Control-Allow-Origin', origin); | ||
| res.setHeader('Access-Control-Allow-Origin', origin); | ||
| if(!verificationCode) { | ||
| @@ -261,3 +261,3 @@ | ||
| nodeConnector.triggerPeer(EVENT_CONNECTED, "ok"); | ||
| origin && res.setHeader('Access-Control-Allow-Origin', origin); | ||
| res.setHeader('Access-Control-Allow-Origin', origin); | ||
| res.setHeader('Access-Control-Allow-Credentials', 'true'); |
|
2 participants
No description provided.