Insecure Cross-Origin Resource Sharing Configuration

[TheLalaMan]

A routine security scan made me aware of the fact that the plugin uses a rather insecure CORS header configuration:

/api/kd-gdpr-cc?siteNode=/sites/lala@live;language=en

The scanner has detected an insecure CORS configuration on the target application : The application is configured to allow a public third party service to issue cross-domains requests. This configuration allows an attacker to host a malicious javascript on this public third service and then perform cross-domains requests with user credentials and access the responses.

Access-Control-Allow-Origin header should be set to allow only known and trusted domains to issue CORS requests.

Which in turn made me think about why the configuration is even there- I do not see the use case to allow Cross-origin requests in cookie plugin. Maybe you could explain that?

Also looking at the code I saw that for a long time there was a TODO related to the CORS header configuration to make this configurable, which would be beneficial for us.

I would be happy to assist with a PR once I fully understand the use case behind the loose CORS header configuration!

[ecoben]

+1 for making the CORS headers configurable (or block CORS altogether?) This would resolve the TODO mentioned previously in https://github.com/KaufmannDigital/KaufmannDigital.GDPR.CookieConsent/blob/5a18d72a9bb305b40bf3dd65ad50eaa44cd79c4e/Classes/Controller/ApiController.php#L50

[Nikdro]

Hey @ecoben and @TheLalaMan,

thanks for your Feedback. I'll have a look on it the next days and come back to you with details then :)

[ecoben]

@Nikdro and I have agreed on the following today:

• It would be good (and acceptable for other users of the package) to restrict CORS and set headers only if the domain can be found in a whitelist of allowed domains.
• Default behaviour should be to not allow CORS.
• @Nikdro or his colleagues could alert current users, who need CORS to be permitted, to this change.
• A PR from DE-CIX would be welcome. :-)

[ecoben]

The PR by @ru3fu5z is ready for review: https://github.com/KaufmannDigital/KaufmannDigital.GDPR.CookieConsent/pull/52

Would you look into it when you find time, @Nikdro ?