An Echo CORS middleware is configured to allow every origin with the wildcard "*".

Why this matters

Echo uses its own middleware.CORSConfig struct, which is missed by the generic cors.Config / cors.Options CORS checks. A wildcard origin lets any website make cross-origin requests to this API, defeating the same-origin policy (CWE-942); with AllowCredentials: true it becomes an account-takeover primitive that leaks OAuth/OIDC tokens cross-origin. LLM-generated Echo setups often paste []string{"*"} to "make the browser call work".

Restrict to an explicit allowlist, e.g. middleware.CORSConfig{AllowOrigins: []string{"https://app.example.com"}} and never combine a wildcard origin with credentials.

package main

import (
	"github.com/labstack/echo/v4"
	"github.com/labstack/echo/v4/middleware"
)

func setup(e *echo.Echo) {
	// ruleid: auth.go.cors.echo-wildcard
	e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
		AllowOrigins:     []string{"*"},
		AllowCredentials: true,
	}))

	// ruleid: auth.go.cors.echo-wildcard
	e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
		AllowOrigins: []string{"https://app.example.com", "*"},
	}))
}

package main

import (
	"github.com/labstack/echo/v4"
	"github.com/labstack/echo/v4/middleware"
)

func setupSafe(e *echo.Echo) {
	// Explicit allowlist: not flagged.
	e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
		AllowOrigins:     []string{"https://app.example.com"},
		AllowCredentials: true,
	}))
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.cors.echo-wildcard -- <reason>

References