checkId: check.security.cors plugin: stellaops.doctor.security severity: warn tags: [security, cors, web]

CORS Configuration

What It Checks

Validates Cross-Origin Resource Sharing (CORS) security settings. The check inspects Cors:* and Security:Cors:* configuration sections:

Condition	Severity	Issue
`AllowAnyOrigin` is `true`	`fail`	Any origin can make cross-origin requests
`AllowAnyOrigin` + `AllowCredentials` both true	`fail`	Critical: any origin can send credentialed requests
Wildcard `*` in `AllowedOrigins` array	`warn`	Wildcard provides no protection
No allowed origins configured	`warn`	CORS origins not explicitly defined
Non-HTTPS origin (except localhost/127.0.0.1)	`warn`	Non-HTTPS origins are insecure

Evidence collected includes: allowed origins list (up to 5), AllowCredentials flag, AllowAnyOrigin flag, and configured methods.

Overly permissive CORS configuration allows malicious websites to make authenticated API requests on behalf of logged-in users. If AllowAnyOrigin is combined with AllowCredentials, an attacker’s site can read responses from the Stella Ops API using the victim’s session cookies. This can lead to data exfiltration, unauthorized release approvals, or policy modifications.

Common Causes

CORS allows any origin (AllowAnyOrigin: true) – common in development, dangerous in production
CORS wildcard origin * configured in the allowed origins list
CORS allows any origin with credentials enabled simultaneously
Allowed origins include non-HTTPS URLs in production
No CORS allowed origins configured at all

How to Fix

Docker Compose

Set explicit CORS origins in environment variables:

environment:
  Cors__AllowAnyOrigin: "false"
  Cors__AllowCredentials: "true"
  Cors__AllowedOrigins__0: "https://stella-ops.local"
  Cors__AllowedOrigins__1: "https://console.stella-ops.local"
  Cors__AllowedMethods__0: "GET"
  Cors__AllowedMethods__1: "POST"
  Cors__AllowedMethods__2: "PUT"
  Cors__AllowedMethods__3: "DELETE"

Bare Metal / systemd

Edit appsettings.json:

{
  "Cors": {
    "AllowAnyOrigin": false,
    "AllowCredentials": true,
    "AllowedOrigins": [
      "https://stella-ops.yourdomain.com"
    ],
    "AllowedMethods": ["GET", "POST", "PUT", "DELETE"]
  }
}

Kubernetes / Helm

Set in Helm values:

cors:
  allowAnyOrigin: false
  allowCredentials: true
  allowedOrigins:
    - "https://stella-ops.yourdomain.com"
  allowedMethods:
    - GET
    - POST
    - PUT
    - DELETE

Verification

stella doctor run --check check.security.cors

check.security.headers — validates other HTTP security headers (HSTS, CSP, X-Frame-Options)
check.core.auth.config — authentication must complement CORS to prevent unauthorized access