From claudient
Audits CORS configuration for overly permissive origins, credential misuse, and origin reflection. Scans server entrypoints, middleware, and framework configs across Express, Django, FastAPI, Spring, Nginx, and CDN layers.
How this command is triggered — by the user, by Claude, or both
Slash command
/claudient:cors-config [server file or framework config]security/The summary Claude sees in its command listing — used to decide when to auto-load this command
Audit the CORS (Cross-Origin Resource Sharing) configuration in `$ARGUMENTS` (default: scan all server entrypoints, middleware files, and framework configs) for misconfigurations that enable cross-origin attacks.
**1. Locate CORS configuration**
Find all places CORS headers are set:
- Express/Node: `cors()` middleware, manual `res.setHeader('Access-Control-Allow-Origin', ...)`
- Django: `CORS_ALLOWED_ORIGINS`, `CORS_ALLOW_ALL_ORIGINS`, `django-cors-headers` settings
- FastAPI/Starlette: `CORSMiddleware` parameters
- Spring: `@CrossOrigin`, `WebMvcConfigurer.addCorsMappings`
- Nginx/Apache...Audit the CORS (Cross-Origin Resource Sharing) configuration in $ARGUMENTS (default: scan all server entrypoints, middleware files, and framework configs) for misconfigurations that enable cross-origin attacks.
1. Locate CORS configuration
Find all places CORS headers are set:
cors() middleware, manual res.setHeader('Access-Control-Allow-Origin', ...)CORS_ALLOWED_ORIGINS, CORS_ALLOW_ALL_ORIGINS, django-cors-headers settingsCORSMiddleware parameters@CrossOrigin, WebMvcConfigurer.addCorsMappingsadd_header Access-Control-Allow-Origin directives2. Check for wildcard origin with credentials
The most critical misconfiguration:
Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true?3. Check for origin reflection
Origin request header directly into Access-Control-Allow-Origin without validation?request.headers.origin or $_SERVER['HTTP_ORIGIN'] and echoes it into the response header.* but bypasses the credentials restriction.4. Validate the allowed origins list
origin.startsWith('https://example.com') allows https://example.com.attacker.comorigin.endsWith('example.com') allows https://attackerexample.comnull origins permitted? (triggered by sandboxed iframes and file:// — almost never appropriate)5. Check preflight handling
OPTIONS preflight requests handled and returning correct Access-Control-Allow-Methods and Access-Control-Allow-Headers?Content-Type: text/plain)?6. Check exposed headers
Access-Control-Expose-Headers include headers that leak sensitive info (e.g., internal service names, session tokens, user IDs)?7. Check per-route vs global config
Output format:
## CORS Audit
### Findings
[SEVERITY] [file:line or config key] — description
Attack scenario: what an attacker can do from a malicious origin
Fix: exact configuration change
### Current Allowed Origins
[List each configured origin and whether it's appropriate]
### Recommended Configuration
[Paste a corrected config snippet for the framework in use]
Severity: Critical (origin reflection or wildcard+credentials), High (overly broad regex), Medium (null origin, excess exposed headers), Low (preflight gaps on non-sensitive routes).
npx claudepluginhub claudient/claudient --plugin claudient-personas