Description

Detects insecure CORS configurations in Go Gin applications where Access-Control-Allow-Origin header is set to a wildcard (*) while credentials are allowed. This combination can expose sensitive data to malicious websites by allowing any origin to make authenticated requests to the application.

Detection Strategy

• Check for header setting operations in Go code that configure Access-Control-Allow-Origin

• Verify if the header value is set to a wildcard (*) or other unsafe origin patterns

• Flag the configuration as vulnerable when Access-Control-Allow-Origin is set to an unsafe value that allows all origins

Vulnerable code example

package main

import "github.com/gin-gonic/gin"

func configureCORS() gin.HandlerFunc {
    return func(c *gin.Context) {
        // Vulnerable: Using wildcard origin '*' with Allow-Credentials true is insecure
        c.Header("Access-Control-Allow-Origin", "*")...

✅ Secure code example

package main

import "github.com/gin-gonic/gin"

func configureCORS() gin.HandlerFunc {
    return func(c *gin.Context) {
        // Safe: Specify exact allowed origin instead of wildcard when using credentials
        origin := c.Request.Header.Get("Origin")...