Cors Wildcard in Sails with Basic Auth

When an API built with Sails.js uses both a wildcard CORS policy and HTTP Basic Authentication, it can unintentionally permit cross-origin authenticated requests that should be restricted. In Sails, the CORS configuration is typically defined in config/cors.js. A common developer mistake is setting origin: "*" while also expecting Basic Auth (a username and password transmitted in the Authorization header) to protect access.

Browsers enforce CORS for cross-origin requests that include credentials such as HTTP Basic Auth. If credentials: true is not set alongside a specific origin, a wildcard origin: "*" is disallowed by the browser when credentials are present. However, some non-browser clients or misconfigured HTTP clients may not enforce this rule strictly. In Sails, if the CORS settings permit any origin and the application accepts Basic Auth, an attacker can craft a request from an arbitrary origin that includes valid credentials. Because CORS is a browser-enforced mechanism, server-side Sails code might still process the request as authenticated, assuming the Authorization header is valid.

This combination exposes two related risks. First, it can facilitate cross-origin authenticated requests where the origin is not explicitly trusted, potentially bypassing intended access controls. Second, if the API also reflects or leaks request details, it may aid in further attacks such as CSRF or unauthorized data access. For example, an attacker’s webpage could include an Image tag or an XMLHttpRequest that sends a request with Basic Auth headers to the Sails endpoint. While the browser may block the response in a web context, the server has already processed the request, and any side effects or data exposure occur.

Using middleBrick to scan such an API will flag the CORS misconfiguration and the presence of Basic Auth in unauthenticated scans, highlighting the risky pairing. The scanner’s checks for Authentication and Property Authorization can surface the exposed endpoint, and findings will include remediation guidance to align the CORS policy with the authentication mechanism.

To secure a Sails API that uses HTTP Basic Authentication, explicitly define allowed origins and ensure that CORS settings match the trust boundary of your authentication. Avoid using a wildcard origin when credentials are required. Below is a minimal, secure configuration example.

// config/cors.js
module.exports.cors = {
  origin: 'https://trusted.example.com',
  credentials: true,
  allowHeaders: ['authorization', 'content-type'],
  exposedHeaders: [],
  maxAge: 3600,
  routes: {
    // exclude paths that do not need CORS, such as health checks
    ignoreRoutes: ['swagger.json', 'health']
  }
};

In your Sails controllers or policies, validate the Origin header when processing requests that include Basic Auth. This reinforces CORS enforcement at the application level. Here is an example policy that checks the origin before allowing the request to proceed.

// api/policies/basicAuthCorsPolicy.js
module.exports = function (req, res, next) {
  const allowedOrigin = 'https://trusted.example.com';
  const requestOrigin = req.headers.origin;
  const authHeader = req.headers.authorization;

  if (authHeader && authHeader.startsWith('Basic ')) {
    if (requestOrigin !== allowedOrigin) {
      return res.forbidden({
        error: 'CORS origin not allowed',
        message: 'Requests with Basic Auth must come from the trusted origin.'
      });
    }
  }
  return next();
};

Ensure your Basic Auth implementation does not leak credentials in logs or error messages. When parsing the Authorization header, avoid exposing the raw header value. Below is a safe example of extracting and validating credentials in a Sails route without echoing sensitive data.

// api/controllers/UserController.js
const auth = require('basic-auth');

module.exports = {
  login: function (req, res) {
    const user = auth(req);
    if (!user || !validateCredentials(user.name, user.pass)) {
      return res.unauthorized('Invalid credentials');
    }
    // Proceed with authenticated logic
    return res.ok({ session: 'token-or-cookie-based-session' });
  }
};

For production, prefer token-based authentication over Basic Auth where possible, but if you must use Basic Auth, enforce strict CORS rules and monitor scans with tools like middleBrick to detect misconfigurations early.