CORS allows resources to access function apps misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_62
Category - Subcategory	Public Exposure - APIs
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.

How to Fix

Resource: azurerm_function_app

• Arguments: site_config.cors [source,go]

---

resource "azurerm_function_app" "example" { ... site_config {

• cors {

• allowed_origins = ["192.0.0.1"] } } }

---