Python · security

no-cors-wildcard-with-credentials

python:no-cors-wildcard-with-credentials

Credentialed CORS must not allow a wildcard origin.

Code: SARJ028
Default: error
Fix: none
Languages: python

Why

Reflecting any origin while allowing credentials lets an untrusted site read authenticated responses.

Fix

Replace the wildcard with an explicit list of trusted origins.

Before / after

Executed by this rule’s unit tests.

Before

Credentials allowed for every origin

app/main.py · focus

from fastapi.middleware.cors import CORSMiddleware
app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=True)

After

Credentials restricted to a trusted origin

app/main.py · focus

from fastapi.middleware.cors import CORSMiddleware
app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://app.example.com"],
    allow_credentials=True,
)

Limits

The rule requires literal `True` for `allow_credentials` and either a literal `"*"` below `allow_origins` or an exact universal `allow_origin_regex` literal.
Dynamically computed credential flags and origin collections are not resolved.