highConfiguration

Overly Permissive CORS

CORS is configured to allow requests from any origin.

Why it matters

Wildcard CORS means any website on the internet can make API requests on behalf of your users. Combined with credentials, an attacker's website can steal user data by making authenticated cross-origin requests to your API.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

CORS wildcard origin
app.use(cors({ origin: '*' }));

The smallest fix

minimal patch
// Restrict to your domain:
app.use(cors({
  origin: 'https://yourdomain.com',
  credentials: true
}));

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

The file [the file] at line [the line number] has overly permissive CORS: [the flagged code]. Restrict the origin to your specific domain(s).

How to check the fix worked

1. Make a request from a different origin — expect CORS error
2. Make a request from your allowed origin — expect success
3. Verify credentials mode works correctly

Further reading