Cors Wildcard in Echo Go with Basic Auth

In Go APIs built with the Echo framework, a CORS wildcard (Access-Control-Allow-Origin: *) combined with Basic Authentication can unintentionally expose protected resources to any origin. When credentials or authorization headers are involved, browsers enforce stricter rules: a wildcard origin is not sufficient to allow requests that include Authorization headers unless the server explicitly lists origins or sets Access-Control-Allow-Credentials: true alongside a non-wildcard origin.

Echo allows CORS configuration via the echo-contrib/cors middleware. A common misconfiguration is to set AllowedOrigins: []string{"*"} while also returning WWW-Authenticate challenges for Basic Auth. This combination can cause browsers to block frontend JavaScript from reading responses, while non-browser clients (such as curl) still succeed. Attackers may leverage this mismatch to probe for Auth-protected endpoints via alternative clients or to craft social engineering scenarios where a logged-in user is tricked into issuing authenticated requests from a malicious origin that appears allowed due to the wildcard.

Additionally, if preflight requests are not properly validated, an origin wildcard with Basic Auth can permit unauthorized methods or headers. For example, a preflight request with Access-Control-Request-Method: DELETE might be allowed through if the server’s CORS configuration does not restrict methods. This can expose authentication-protected mutation endpoints to unauthorized usage from any site, especially when the browser’s same-origin policy is bypassed by the wildcard in combination with the presence of credentials.

To detect this specific risk pattern, middleBrick runs checks that correlate CORS headers with authentication mechanisms. It inspects whether a wildcard origin coexists with protected routes that require Basic Auth and flags cases where credentials-bearing requests are allowed from any origin. The scanner also examines preflight handling and whether response headers expose authentication-related information that could aid an attacker.

Remediation focuses on ensuring that when Basic Authentication is used, origins are explicitly defined and credentials are handled securely.

• Replace the wildcard with a controlled allow-list of origins. For example:

package main

import (
	"net/http"

	"github.com/labstack/echo/v4"
	"github.com/labstack/echo/v4/middleware"
)

func main() {
	e := echo.New()

	// Configure CORS with explicit origins and credentials support
	e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
		AllowOrigins: []string{"https://app.yourcompany.com", "https://admin.yourcompany.com"},
		AllowMethods: []string{http.MethodGet, http.MethodPost, http.MethodPut, http.MethodDelete},
		AllowHeaders: []string{echo.HeaderAuthorization, echo.HeaderContentType, echo.HeaderAccept},
		ExposeHeaders: []string{echo.HeaderContentType},
		AllowCredentials: true,
	}))

	// Protected route requiring Basic Auth
	e.GET("/secure", func(c echo.Context) error {
		user, pass, ok := c.Request().BasicAuth()
		if !ok || !validateBasicAuth(user, pass) {
			return c.String(http.StatusUnauthorized, "Unauthorized")
		}
		return c.String(http.StatusOK, "Access granted")
	})

	e.Start(":8080")
}

func validateBasicAuth(user, pass string) bool {
	// Replace with secure credential validation (e.g., constant-time compare)
	return user == "admin" && pass == "s3cr3t"
}

• Ensure that preflight responses do not over-permissive methods or headers. Explicitly define allowed methods and headers rather than relying on defaults.

// Example of tighter preflight control within CORS config
// (handled by the middleware; ensure AllowMethods and AllowHeaders are limited)

• Do not include the Authorization header in CORS exposed headers unless necessary. If you must expose it for legacy reasons, limit exposure strictly to required origins and avoid wildcard origins.

middleBrick’s scans verify that when Basic Auth is detected, CORS origins are not set to * and that credentials-bearing requests are restricted to known, safe origins. The tool also checks for overly permissive preflight configurations that could weaken the protection provided by Basic Auth.