v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.fastify.cors-wildcard-credentials

@fastify/cors is registered with a wildcard/reflected origin (origin: '*' or origin: true) together with credentials: true.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

The CORS spec forbids Access-Control-Allow-Origin: * with credentials, so origin: true reflects the caller's origin back instead, effectively allowing credentialed cross-site requests from ANYWHERE. That is a CSRF / account-takeover primitive.

Enumerate the exact trusted origins instead: fastify.register(cors, { origin: ['https://app.example.com'], credentials: true }), or pass a function that validates the origin against an allowlist. If the API is public and needs no cookies or auth headers, keep credentials at its default false.

VULNERABLE
vulnerable.ts
import Fastify from 'fastify';
import fastifyCors from '@fastify/cors';

const fastify = Fastify();

// ruleid: auth.fastify.cors-wildcard-credentials
fastify.register(fastifyCors, { origin: '*', credentials: true });

// ruleid: auth.fastify.cors-wildcard-credentials
fastify.register(fastifyCors, { credentials: true, origin: true });
SAFE
safe.ts
import Fastify from 'fastify';
import fastifyCors from '@fastify/cors';

const fastify = Fastify();

// ok: auth.fastify.cors-wildcard-credentials -- explicit allowlist + credentials
fastify.register(fastifyCors, {
  origin: ['https://app.example.com', 'https://admin.example.com'],
  credentials: true,
});

// ok: auth.fastify.cors-wildcard-credentials -- public API, credentials stays off
fastify.register(fastifyCors, { origin: '*' });

// ok: auth.fastify.cors-wildcard-credentials -- single trusted origin string
fastify.register(fastifyCors, { origin: 'https://app.example.com', credentials: true });

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.fastify.cors-wildcard-credentials -- <reason>

References

https://github.com/fastify/fastify-cors#options ↗https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials ↗