rspec/rules/S5122/recommended.adoc
2021-01-27 13:42:22 +01:00

5 lines
414 B
Plaintext

== Recommended Secure Coding Practices
* The ``++Access-Control-Allow-Origin++`` header should be set only for a trusted origin and for specific resources.
* Allow only selected, trusted domains in the ``++Access-Control-Allow-Origin++`` header. Prefer whitelisting domains over blacklisting or allowing any domain (do not use * wildcard nor blindly return the ``++Origin++`` header content without any checks).