漏洞修复：HTML5: Overly Permissive CORS Policy

描述

A resource on the target website has been found to be shared across websites using CORS with an open access control policy. Cross-Origin Resource Sharing, commonly referred to as CORS, is a technology that allows a domain to define a policy for its Review your Cross-Origin-Resource-Sharing policy and consider restricting access to only trusted domains. Never use wildcard open-access permissions (e.g. “*”) in the Access-Control-Allow-Origin header. Additionally, do not automatically include Access -Control-Allow-Origin headers in the response unless the request is cross-domain. Alternatively, implement an allow list of known domains that are allowed to access this domain and only include domains that actually tried to access the resource. Otherwise, reject the request and reply with only host domain not exposing all allowed domains. Reserve the use of CORS for resources that cannot be shared in other ways (e.g. JavaScript can be accessed using SCRIPT tag as well as images can be accessed using IMG tag from other domains). Finally, make sure that this resource does not disclose any sensitive information and only share resources required to preserve functionality in contrast to an open domain CORS access.

解决方案

在server中添加
add_header Access-Control-Allow-Origin 允许访问的ip或者域名,允许访问的ip或者域名;
例如：

server{
	add_header Access-Control-Allow-Origin  192.168.11.62;
}

或者

server{
	add_header 'Access-Control-Allow-Origin' $http_origin;
}

实际情况中，还是扫到了
另一个解决方案
判断$http_origin
如果不在白名单，直接403

if ( $http_origin !~* '192.168.1.1|172.1.1.1') {
        return 403 ;
}

参考

https://blog.csdn.net/CutelittleBo/article/details/122728054