Skip to content
Sarj Standards

TypeScript · security

no-cors-wildcard-with-credentials

eslint:no-cors-wildcard-with-credentials

Disallow wildcard CORS origins when credentials are enabled.

Default
error
Fix
none
Languages
typescript

Why

Reflecting every origin while allowing credentials can let an untrusted site read authenticated cross-origin responses.

Fix

Enumerate the trusted origins that may receive credentialed responses.

Before / after

Executed by this rule’s unit tests.

Before

Credentials are enabled for every origin

src/server.ts · focus
app.use(cors({ origin: '*', credentials: true }));

After

Credentials are limited to a trusted origin

src/server.ts · focus
app.use(cors({ origin: 'https://app.example.com', credentials: true }));

Limits

  • The rule detects literal CORS option and header combinations within the same syntactic scope; it does not resolve runtime configuration.

Message IDs

corsWildcardWithCredentials