Skip to content

fix(azure): read cors.supportCredentials in accessControlAllowCredential - #2209

Open
Anmol7091 wants to merge 1 commit into
aquasecurity:masterfrom
Anmol7091:fix/azure-cors-support-credentials
Open

Anmol7091 wants to merge 1 commit into
aquasecurity:masterfrom
Anmol7091:fix/azure-cors-support-credentials

Conversation

@Anmol7091

Copy link
Copy Markdown

Fixes #2208

accessControlAllowCredential read cors.supportedCredentials, but the Azure API returns
cors.supportCredentials. The check therefore always failed, even when
"Enable Access-Control-Allow-Credentials" was turned on.
The typo dates back to the original implementation in #1935.

Changes

  • plugins/azure/appservice/accessControlAllowCredential.js: read cors.supportCredentials (line 49)
  • plugins/azure/appservice/accessControlAllowCredential.spec.js: use the real Azure property name in mock data

Testing

  • npx mocha plugins/azure/appservice/accessControlAllowCredential.spec.js: 4 passing
  • npx eslint plugins/azure/appservice/accessControlAllowCredential.js: no errors
  • Azure API response for a Function App with "Enable Access-Control-Allow-Credentials" turned on,
    using the same API version as the collector (2019-08-01):
az rest --method get \
  --url "https://management.azure.com/subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.Web/sites/<function_app>/config/web?api-version=2019-08-01" \
  --query properties.cors
{
  "allowedOrigins": [
    "https://portal.azure.com"
  ],
  "supportCredentials": true
}

The property is supportCredentials; supportedCredentials is not present in the response.

@CLAassistant

CLAassistant commented Nov 3, 2026 •

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Azure] accessControlAllowCredential always fails: reads cors.supportedCredentials instead of cors.supportCredentials

2 participants