58 lines
1.0 KiB
Plaintext
58 lines
1.0 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
header("Access-Control-Allow-Origin: *"); // Sensitive
|
|
----
|
|
|
|
Laravel
|
|
|
|
----
|
|
response()->header('Access-Control-Allow-Origin', "*"); // Sensitive
|
|
----
|
|
|
|
Symfony
|
|
|
|
----
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
$response = new Response(
|
|
'Content',
|
|
Response::HTTP_OK,
|
|
['Access-Control-Allow-Origin' => '*'] // Sensitive
|
|
);
|
|
$response->headers->set('Access-Control-Allow-Origin', '*'); // Sensitive
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
----
|
|
header("Access-Control-Allow-Origin: $trusteddomain"); // Compliant
|
|
----
|
|
|
|
Laravel
|
|
|
|
----
|
|
response()->header('Access-Control-Allow-Origin', $trusteddomain); /// Compliant
|
|
----
|
|
|
|
Symfony
|
|
|
|
----
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
$response = new Response(
|
|
'Content',
|
|
Response::HTTP_OK,
|
|
['Access-Control-Allow-Origin' => $trusteddomain] /// Compliant
|
|
|
|
$response->headers->set('Access-Control-Allow-Origin',$trusteddomain); // Compliant
|
|
----
|
|
|
|
include::../see.adoc[]
|