CORS should not allow every resource to access API Apps

What does the recommendation "CORS should not allow every resource to access API Apps" check?

Flags an App Service API app whose Cross-Origin Resource Sharing configuration lists the wildcard origin '*' in allowedOrigins, meaning a browser on any site can issue cross-origin requests to the app's endpoints. It inspects only the platform-level CORS setting exposed under the app's cors property. It does not read CORS headers your own application code emits from middleware, nor does it check which HTTP methods or headers you allow, whether credentials are permitted, or whether your authentication and authorisation are sound. A specific but overly broad origin list still passes; only the literal '*' is caught. The original recommendation, '[Deprecated]: CORS should not allow every resource to access your API App', has been deprecated by Microsoft, so newer subscriptions surface the equivalent App Service check 'App Service apps should not have CORS configured to allow every resource to access your apps'.

Why does "CORS should not allow every resource to access API Apps" matter?

A wildcard CORS origin tells browsers that script on any website may read your API's responses. If a user with an active session visits an attacker's page, that page can call your API in the user's context and exfiltrate whatever the responses contain. For an API app this often means account data, tokens echoed in payloads or internal records that were never meant to leave a trusted front end. CORS is not an authentication control, but a permissive policy widens the blast radius of any session-handling or token weakness and turns a single phishing click into data theft. Restricting origins to the front ends you actually operate closes that browser-driven path and keeps cross-site abuse out of the picture.

How do I fix "CORS should not allow every resource to access API Apps"?

1. List the current origins with 'az webapp cors show --name <app> --resource-group <rg>' and confirm the entry '*' is present.
2. Remove the wildcard and add only the front-end origins you own: 'az webapp cors remove --name <app> --resource-group <rg> --allowed-origins' (with no value clears the list), then 'az webapp cors add --name <app> --resource-group <rg> --allowed-origins https://app.contoso.com https://admin.contoso.com'. In Bicep, set the site's siteConfig.cors.allowedOrigins array to those explicit origins instead of ['*'].
3. Enforce it going forward by assigning the built-in policy. Look the definition up by display name so you never hardcode a GUID: pid=$(az policy definition list --query "[?displayName=='App Service apps should not have CORS configured to allow every resource to access your apps'].name" -o tsv); az policy assignment create --name no-wildcard-cors --policy "$pid" --scope <scope>.

SUB="/subscriptions/00000000-0000-0000-0000-000000000000"
RG="rg-app-prod"

# Harden every app that is not already HTTPS-only.
for app in $(az webapp list -g "$RG" \
    --query "[?!httpsOnly].name" -o tsv); do
  # 1. Force HTTPS on the site itself.
  az webapp update -g "$RG" -n "$app" --https-only true
  # 2. Turn off the remote debugger.
  az webapp config set -g "$RG" -n "$app" --remote-debugging-enabled false
  # 3. Drop any wildcard CORS origin (replace with your own origins after).
  az webapp cors remove -g "$RG" -n "$app" --allowed-origins '*'
  echo "$app: HTTPS forced, remote debugging off, wildcard CORS removed"
done

# Ratchet it shut: deny any future app that is not HTTPS-only.
# Look the built-in policy up by display name, never hardcode the GUID.
pid=$(az policy definition list \
  --query "[?displayName=='App Service apps should only be accessible over HTTPS'].name" -o tsv)
az policy assignment create \
  --name deny-appservice-http \
  --policy "$pid" \
  --scope "$SUB"