Permissive CORS (ARCH3121)

Key typescript.security.permissive-cors · Severity warning · Category security · CWE CWE-942

Configuring CORS with a wildcard origin (*), especially together with credentials: true, lets any site call your API with authenticated requests.

Incorrect

import cors from "cors";

app.use(cors({ origin: "*", credentials: true }));

Correct

import cors from "cors";

const allowed = ["https://app.example.com"];
app.use(cors({
  origin: (o, cb) => cb(null, !o || allowed.includes(o)),
  credentials: true,
}));

Fix

Use an allowlist of origins; never combine the * wildcard origin with credentials: true.