SH002: Permissive CORS configuration

Severity: medium · Category: security · Applies to: node

Why it matters

Allowing every origin lets any website call the API from a visitor's browser. Combined with credentials it exposes authenticated sessions.

How to fix

List the exact origins that need access instead of '*' or a bare cors() call.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH002

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH002