feat(protect): cors_reflected match type for CORS-misconfiguration detection

[patchstackdave]

Why

The third origin-comparison capability unlocked by threading the request into the response phase (#106), after cross_origin (CSRF) and off_origin (open-redirect, #109). CORS misconfiguration — a response that reflects the caller's Origin and allows credentials — lets any site read the authenticated response; a common, high-impact bug in AI-built APIs.

What

New cors_reflected response-phase match type (dispatched like cross_origin, needs the whole resolver):

• Matches (→ action: block) when Access-Control-Allow-Credentials: true AND the Access-Control-Allow-Origin either is * or echoes the request Origin (so every origin is allowed).
• A fixed allowlisted origin, reflection without credentials, or no CORS headers → not flagged. Can't false-positive without the signal.

{ "phase": "response", "category": "cors", "action": "block",
  "when": { "path": "/api/*" },
  "rule_v2": [{ "match": { "type": "cors_reflected" } }] }

Blocking withholds the response, preventing the cross-origin read. Not a default — authored and route-scoped. (A future header-mutation action — strip ACAC / pin ACAO — would be a gentler mitigation than a full block; noted for later.)

Tests

tests/protect/cors-reflection.test.ts — 6: reflected-origin + credentials blocked, wildcard + credentials blocked, fixed allowlist allowed, reflection-without-credentials allowed, no-CORS-headers allowed, when route scope. 632 pass; typecheck clean.

🤖 Generated with Claude Code

[coderbuds]

Well-structured CORS misconfiguration detection feature with comprehensive tests.

🎯 Quality: 100% Elite · 📦 Size: Small

📈 This month: Your 50th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review