Cors Wildcard in Django with Basic Auth

Remediation centers on tightening CORS settings and ensuring that Basic Auth is only accepted over HTTPS with strict origin policies. Below are concrete, syntactically correct Django configurations and view examples that address the intersection of CORS and Basic Auth.

1. Secure CORS settings

Instead of allowing all origins, explicitly list trusted origins and disable credentials for wildcard scenarios. If credentials are required, list origins individually.

# settings.py
INSTALLED_APPS = [
    ...,
    'corsheaders',
]

MIDDLEWARE = [
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.security.SecurityMiddleware',
    ...,
]

# Allow only specific origins and credentials
CORS_ALLOWED_ORIGINS = [
    'https://app.yourdomain.com',
    'https://admin.yourdomain.com',
]
CORS_ALLOW_CREDENTIALS = True  # Only set to True if you explicitly list origins above

# Ensure no wildcard is used when credentials are true
CORS_ORIGIN_ALLOW_ALL = False

2. Enforce HTTPS and Basic Auth at the view level

Use Django’s built-in authentication classes and require secure transport. The following example demonstrates a view that validates HTTP Basic Authentication and rejects requests on non-HTTPS in production.

# views.py
from django.contrib.auth import authenticate
from django.http import JsonResponse, HttpResponse
from django.views import View
from django.utils.decorators import method_decorator
from django.views.decorators.http import require_http_methods
import base64

class SecureBasicAuthView(View):
    @method_decorator(require_http_methods(["GET", "POST"])
    def dispatch(self, request, *args, **kwargs):
        # Enforce HTTPS in production
        if not request.is_secure():
            return JsonResponse({'error': 'HTTPS required'}, status=403)

        auth = request.META.get('HTTP_AUTHORIZATION', '')
        if not auth.lower().startswith('basic '):
            return HttpResponse(status=401, headers={'WWW-Authenticate': 'Basic realm="api"'})

        try:
            decoded = base64.b64decode(auth.split(' ', 1)[1]).decode('utf-8')
            username, password = decoded.split(':', 1)
            user = authenticate(request, username=username, password=password)
            if user is not None:
                # Proceed with business logic
                return JsonResponse({'status': 'ok'})
            return HttpResponse(status=401, headers={'WWW-Authenticate': 'Basic realm="api"'})
        except Exception:
            return HttpResponse(status=400)

3. Use middleware to reject wildcard origins dynamically

For additional assurance, add a lightweight middleware that validates the Origin header when credentials are present.

# middleware.py
from django.http import HttpResponseForbidden

TRUSTED_ORIGINS = {
    'https://app.yourdomain.com',
    'https://admin.yourdomain.com',
}

class StrictCorsMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)
        origin = request.META.get('HTTP_ORIGIN')
        if origin and request.META.get('HTTP_AUTHORIZATION'):
            if origin not in TRUSTED_ORIGINS:
                response['Access-Control-Allow-Origin'] = ''
                response.status_code = 403
        return response

4. Combine with CSRF protection for state-changing methods

When using Basic Auth, ensure that mutating endpoints also validate CSRF tokens for same-origin browser requests, or explicitly exempt API views if they are intended to be consumed by external clients using token-based schemes.

middleBrick’s GitHub Action can be added to CI/CD pipelines to automatically detect CORS misconfigurations and weak authentication setups before deployment. Its CLI allows you to scan specific endpoints with middlebrick scan <url> and review JSON output that highlights CORS and authentication issues with severity and remediation guidance.