SH009: Laravel CORS allows every origin¶

Severity: medium · Category: security · Applies to: laravel

Why it matters¶

A wildcard origin lets any website call your API from a visitor's browser. With supports_credentials enabled it can act on behalf of logged-in users.

List the allowed origins in config/cors.php instead of '*'.

Skip it everywhere in devshield.yml:

ignore:
  - SH009

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH009