Skip to content
Sarj Sarj Sarj Standards

no-cors-wildcard-with-credentials

Review wildcard CORS origins combined with an explicit credentials opt-in.

corsWildcardWithCredentials Rule source Tests Catalog JSON

Why

Browsers do not expose credentialed cross-origin responses when Access-Control-Allow-Origin is '*'. Credentialless requests can still use a wildcard even when Access-Control-Allow-Credentials is emitted, so review the intended caller contract.

Fix

Use a trusted explicit origin for credentialed callers, or omit the credentials opt-in for a credentialless wildcard endpoint.

Examples

Before — flagged Review a wildcard that blocks access to credentialed responses
src/server.ts
import cors from "cors";
cors({ origin: "*", credentials: true });
After — preferred Use a trusted origin for credentialed callers
src/server.ts
import cors from "cors";
cors({ origin: "https://app.example.com", credentials: true });

References