mediumWhich sites may call your API

CORS Open to Every Origin

Any website is allowed to make requests to this API from the browser.

Why it matters

CORS exists so that a page on another domain cannot read responses from your API. A wildcard removes that line. Listing the origins you actually serve keeps your own front end working and blocks everyone else.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

flask-cors with defaults
from flask_cors import CORS
app = Flask(__name__)
CORS(app)

The smallest fix

minimal patch
# FastAPI
app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://app.example.com"],
    allow_credentials=True,
    allow_methods=["GET", "POST"],
    allow_headers=["Authorization", "Content-Type"],
)
# Flask
CORS(app, origins=["https://app.example.com"])

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
# Read the allowed origins from an environment variable so staging and
# production differ without a code change:
ALLOWED_ORIGINS = os.getenv("ALLOWED_ORIGINS", "").split(",")

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] CORS allows every origin: [the flagged code]. Replace the wildcard with the exact origins of the front ends that call this API, read from an environment variable, and keep credentials enabled only if those origins need cookies.

How to check the fix worked

1. Send a request with `Origin: https://evil.example` and confirm the
   response has no Access-Control-Allow-Origin header for it.
2. Send one with your real front-end origin and confirm it is allowed.

Further reading