Skip to content
Sarj Sarj Sarj Standards

no-cors-wildcard-with-credentials

Credentialed CORS must not allow a wildcard origin.

SARJ028 Rule source Tests Catalog JSON

Why

Reflecting any origin while allowing credentials lets an untrusted site read authenticated responses.

Fix

Replace the wildcard with an explicit list of trusted origins.

Examples

Before — flagged Credentials allowed for every origin
app/main.py
from fastapi.middleware.cors import CORSMiddleware


app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=True)
After — preferred Credentials restricted to a trusted origin
app/main.py
from fastapi.middleware.cors import CORSMiddleware


app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://app.example.com"],
    allow_credentials=True,
)