SH016: Permissive CORS in a Python, Java or .NET API

Severity: medium · Category: security · Applies to: aspnet, django, fastapi, flask, spring

Why it matters

Allowing every origin lets any website call the API from a visitor's browser. Combined with credentials it exposes authenticated sessions.

How to fix

List the exact origins that need access instead of '*'.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH016

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH016