@sun-asterisk/sunlint/rules/security/S005_no_origin_auth/config.json

☀️ SunLint - Multi-language static analysis tool for code quality and security | Sun* Engineering Standards

{
  "ruleId": "S005",
  "name": "No Origin Header Authentication",
  "description": "Do not use Origin header for authentication or access control",
  "category": "security",
  "severity": "error",
  "languages": ["typescript", "javascript"],
  "version": "1.0.0",
  "status": "stable",
  "tags": ["security", "authentication", "headers", "origin", "access-control"],
  
  "patterns": {
    "vulnerable": [
      "req.headers.origin in authentication context",
      "req.get('origin') for access control",
      "Origin-based conditional authentication",
      "CORS origin configuration mixed with auth",
      "Express middleware using origin for security"
    ],
    "secure": [
      "JWT token authentication",
      "Session-based authentication",
      "API key authentication",
      "OAuth 2.0 flows",
      "Proper CORS configuration without auth reliance"
    ]
  },
  
  "configuration": {
    "checkAuthContext": true,
    "checkMiddleware": true,
    "checkConditionals": true,
    "checkCORSMixing": true,
    "contextDepth": 3,
    "ignoreComments": true
  },
  
  "examples": {
    "violations": [
      {
        "code": "if (req.headers.origin === 'trusted.com') { req.authenticated = true; }",
        "reason": "Using Origin header for authentication is insecure"
      },
      {
        "code": "const authMiddleware = (req, res, next) => { if (req.get('origin') === 'admin.com') next(); }",
        "reason": "Middleware should not rely on Origin header for access control"
      }
    ],
    "valid": [
      {
        "code": "const token = req.headers.authorization; jwt.verify(token, secret, callback);",
        "reason": "Proper JWT token authentication"
      },
      {
        "code": "console.log('Request from:', req.headers.origin);",
        "reason": "Using Origin header for logging only, not authentication"
      }
    ]
  },
  
  "remediation": {
    "recommendations": [
      "Use JWT tokens for authentication",
      "Implement session-based authentication",
      "Use API keys for service authentication",
      "Implement OAuth 2.0 for third-party authentication",
      "Use proper CORS configuration without relying on it for authentication"
    ],
    "resources": [
      "https://owasp.org/www-community/vulnerabilities/CORS_OriginHeaderScrutiny",
      "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin",
      "https://auth0.com/docs/secure/tokens/json-web-tokens"
    ]
  },
  
  "performance": {
    "complexity": "O(n)",
    "accuracy": {
      "ast": 95,
      "regex": 85
    },
    "falsePositiveRate": "< 5%",
    "coverage": "High for TypeScript/JavaScript"
  }
}