Hono's cors() middleware is given an origin function that reflects the caller's origin straight back (origin: (origin) => origin) together with credentials: true.

Why this matters

This echoes ANY requesting origin into Access-Control-Allow-Origin while allowing cookies and Authorization headers, effectively "allow credentialed cross-site requests from anywhere", a CSRF / account-takeover primitive (CWE-942).

Validate the origin against an allow-list before returning it, or pass an explicit list: cors({ origin: ['https://app.example.com'], credentials: true }) cors({ origin: (o) => (allowed.includes(o) ? o : null), credentials: true }) If the API is public and needs no cookies/auth headers, drop credentials (defaults to false).

(A literal origin: '*' with credentials is covered by auth.cors.wildcard-with-credentials; this rule targets the Hono reflect-the-origin function form, which that rule does not match.)

import { Hono } from 'hono';
import { cors } from 'hono/cors';

const app = new Hono();

// ruleid: auth.hono.cors-reflect-credentials
app.use('/api/*', cors({ origin: (origin) => origin, credentials: true }));

// ruleid: auth.hono.cors-reflect-credentials
app.use('/v2/*', cors({ credentials: true, origin: (origin, c) => origin }));

import { Hono } from 'hono';
import { cors } from 'hono/cors';

const app = new Hono();
const allowed = ['https://app.example.com'];

// Explicit allow-list with credentials — safe.
app.use('/api/*', cors({ origin: ['https://app.example.com'], credentials: true }));

// Callback validates the origin against an allow-list — safe.
app.use('/v2/*', cors({ origin: (o) => (allowed.includes(o) ? o : null), credentials: true }));

// Reflects the origin but WITHOUT credentials (public API) — safe.
app.use('/pub/*', cors({ origin: (origin) => origin }));

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.hono.cors-reflect-credentials -- <reason>

References