A Fiber CORS middleware is configured with the wildcard origin "*".

Why this matters

Fiber's cors.Config.AllowOrigins is a single comma-separated STRING (not a []string), so this shape is missed by the generic slice/AllowAllOrigins CORS checks. "*" lets any website make cross-origin requests to this API, defeating the same-origin policy (CWE-942); combined with AllowCredentials: true it becomes an account-takeover primitive that leaks OAuth/OIDC tokens cross-origin. This is a common AI-generated default pasted in to "make the browser call work".

Restrict to an explicit allowlist, e.g. cors.Config{AllowOrigins: "https://app.example.com"} and never combine a wildcard origin with credentials.

package main

import (
	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/cors"
)

func setup(app *fiber.App) {
	// ruleid: auth.go.cors.fiber-wildcard
	app.Use(cors.New(cors.Config{
		AllowOrigins:     "*",
		AllowCredentials: true,
	}))

	// ruleid: auth.go.cors.fiber-wildcard
	app.Use(cors.New(cors.Config{AllowOrigins: "https://app.example.com, *"}))
}

package main

import (
	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/cors"
)

func setupSafe(app *fiber.App) {
	// Explicit allowlist: not flagged.
	app.Use(cors.New(cors.Config{
		AllowOrigins:     "https://app.example.com",
		AllowCredentials: true,
	}))

	app.Use(cors.New(cors.Config{AllowOrigins: "https://a.example.com,https://b.example.com"}))
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.cors.fiber-wildcard -- <reason>

References