Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarification needed for config.origins behavior in CORS plugin documentation #7875

Open
2 tasks done
escudev opened this issue Sep 9, 2024 · 0 comments
Open
2 tasks done
Assignees
Labels

Comments

@escudev
Copy link

escudev commented Sep 9, 2024

Where is the problem?

https://docs.konghq.com/hub/kong-inc/cors/configuration/#config-origins

What happened?

The CORS plugin documentation should clarify that setting config.origins to an empty array [] results in the plugin allowing all origins (*). This behavior is not currently documented and could lead to unintended security risks.

Steps to Reproduce:

  1. Configure the CORS plugin with config.origins set to an empty array [].
  2. The plugin allows all origins (*) instead of denying all origins.

What did you expect to happen?

The CORS plugin documentation should include a hint in the config.origins section of specify that providing an empty array will result in the plugin allowing all origins (*).

Additional Context:

This clarification is important to prevent potential security risks for clients who might expect that an empty array would deny all origins.

Thank you for considering this request to improve the clarity and security of the CORS plugin documentation.

Víctor Escudero [email protected] on behalf of Mercedes-Benz Tech Innovation GmbH

Code of Conduct and Community Expectations

  • I agree to follow this project's Code of Conduct
  • I agree to abide by the Community Expectations
@lmilan lmilan self-assigned this Oct 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants