Fix Apollo CORS Origin Reflection
A security-focused codemod that fixes dangerous CORS origin reflection vulnerabilities in Apollo GraphQL server configurations. This codemod addresses CWE-346: Origin Validation Error and prevents cross-origin credential theft attacks.
Security Issue
Apollo GraphQL servers configured with CORS origin reflection (returning the request origin in Access-Control-Allow-Origin header) create critical security vulnerabilities:
- Cross-Origin Credential Theft: Malicious websites can make authenticated requests and steal user credentials
- CSRF Attacks: Bypass same-origin policy protections
- Unauthorized API Access: Allow malicious origins to access protected GraphQL endpoints
This vulnerability is particularly dangerous when credentials: true is enabled, as it allows cookies and authentication headers to be sent cross-origin.
What This Codemod Fixes
Dangerous Patterns
✅ Fixed: Callback function that reflects any origin
✅ Fixed: Origin set to true with credentials enabled
✅ Fixed: Simple arrow function that returns origin
✅ Fixed: Direct request header access
Safe Patterns (Not Modified)
❌ Already Secure: Explicit origin whitelist arrays
❌ Already Secure: CORS disabled
❌ Already Secure: No CORS configuration
Installation & Usage
Supported Apollo Server Packages
This codemod works with all Apollo Server variants:
apollo-serverapollo-server-expressapollo-server-fastifyapollo-server-koaapollo-server-lambda
Important Post-Migration Steps
⚠️ CRITICAL: After running this codemod, you MUST update the allowedOrigins array with your actual trusted domains:
Security References
- CWE-346: Origin Validation Error
- CVE-2020-15084: Apollo Server CORS vulnerability
- Apollo Server CORS Documentation
- MDN CORS Documentation
- PortSwigger CORS Security
- OWASP Cross-Origin Resource Sharing Cheat Sheet
Development
License
MIT