Skip to content

[HIGH] — WebSocket gateway declares cors.origin: '*' alongside credentials: true, an invalid combination exploitable depending on proxy configuration #7

@Alqku

Description

@Alqku

Severity: High
Type: Security hardening
Scope: Notifications
Labels: security, refactoring

Description

NotificationsGateway (src/notifications/notifications.gateway.ts, lines ~29–34) is annotated with @WebSocketGateway({ cors: { origin: '*', credentials: true } }). Per the CORS specification, browsers reject responses when Access-Control-Allow-Origin: * is combined with Access-Control-Allow-Credentials: true; the dev experience is therefore broken. More importantly, if origin: '*' is interpreted by an upstream proxy as a passthrough (or if a misconfigured Socket.IO adapter echoes a reflected origin), credentialed cross-origin WebSocket connections could be accepted from unintended origins.

Recommendation

  • Replace '*' with an explicit allowlist, e.g. origin: process.env.ALLOWED_ORIGINS?.split(',') ?? [].
  • Set credentials to false unless the gateway needs to forward cookies; JWT auth via the auth.token handshake option does not require credentials.
  • Document the rationale and the env vars in .env.example.

Metadata

Metadata

Assignees

Labels

GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardOfficial CampaignAudit finding under the Official CampaignrefactoringCode restructuring without behavioural changesecuritySecurity vulnerability or hardening

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions