CORS Security Audit (A05:2021)

Analyze PHP code for CORS misconfiguration vulnerabilities.

Detection Patterns

1. Wildcard Origin

// CRITICAL: Allows any website to make requests
header('Access-Control-Allow-Origin: *');

// In framework config:
'allowed_origins' => ['*'], // Any origin!

2. Credentials with Wildcard