Skip to content
Sarj Sarj Sarj Standards

no-cors-wildcard-with-credentials

Disallow wildcard CORS origins when credentials are enabled.

corsWildcardWithCredentials Rule source Tests Catalog JSON

Why

Reflecting every origin while allowing credentials can let an untrusted site read authenticated cross-origin responses.

Fix

Enumerate the trusted origins that may receive credentialed responses.

Examples

Before — flagged Credentials are enabled for every origin
src/server.ts
app.use(cors({ origin: "*", credentials: true }));
After — preferred Credentials are limited to a trusted origin
src/server.ts
app.use(cors({ origin: "https://app.example.com", credentials: true }));