Source kernel · Security

CORS layer lets any origin send credentials

rust_doctor::source::permissive_cors

List the origins allowed to call the API; never combine credentials with a mirrored or wildcard origin, and keep the permissive layer to local development.

Category: Security
Default level: warn
Tier: P1
Producer: Source kernel
Diff scope: item

Not a defect when

The layer is only built for local development or for a public, unauthenticated API whose responses carry no user data.

Crates it waits for

It runs only where at least one of these crates is resolved, and every one resolved sits in the range it was validated on:

actix-cors *
tower-http *

What it reads

Source text, without resolving types or expanding macros.

Tier

Serious: worth interrupting other work for.

The tier bounds how severe a rule may be; its category bounds the tier.

Diff scope

The function or item around the changed line.

What --scope contextual looks at to decide whether a change caused the finding.

Change it

Turn it off, or make it blocking, without touching the code it flags:

rust-doctor --rule rust_doctor::source::permissive_cors=off .
rust-doctor --rule rust_doctor::source::permissive_cors=error .