Fix it in your stack

Tested fixes for CWE-942 in Express, Flask, Spring Boot and ASP.NET Core: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.

Definition

MITRE’s description of CWE-942: The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Common consequences MITRE lists

  • Confidentiality, Integrity, Availability, Access Control: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data; Varies by Context

Why it matters

A permissive policy lets any website read authenticated responses from your API in the victim’s browser, exposing their data.

How to prevent it

  • Allow only an explicit list of trusted origins, compared exactly; never reflect the request’s Origin header.
  • Do not combine Access-Control-Allow-Credentials: true with broad patterns or the null origin.
  • Send Vary: Origin when the response depends on the origin, and test with untrusted origins.

Guides on this site

Main subject · Guide

Configure CORS and CSP around the browser capabilities you need

Control who can read API responses and which resources a page may execute without confusing either control with authorization.

Practice

References

  1. CWE-942 in the MITRE CWE list (version 4.20)

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.