dify - 💡(How to fix) Fix HIGH: CORS allows wildcard * origin — any website can make authenticated API requests

CWE-942: CORS Wildcard * Allows Any Origin to Access API

Severity: HIGH (CVSS 7.5)

Location

api/.env.example:

WEB_API_CORS_ALLOW_ORIGINS=http://localhost:3000,*
CONSOLE_CORS_ALLOW_ORIGINS=http://localhost:3000,*

Description

The default CORS configuration includes a wildcard * origin, which means ANY website can make authenticated cross-origin requests to the Dify API and Console API. This is combined with session cookies that are sent with cross-origin requests.

Impact

• Session hijacking: A malicious website can make authenticated API calls using the victim's session cookie
• Data exfiltration: Attacker can read workflow configurations, API keys, and dataset contents
• CSRF attacks: Attacker can create/delete workflows, modify app configurations, change settings
• Plugin abuse: Attacker can deploy plugins or modify model provider settings

Remediation

1. Remove the * wildcard from default CORS origins
2. Require users to explicitly set their frontend URL
3. Add CSRF token protection for state-changing operations