A Ktor CORS configuration combines anyHost() with allowCredentials = true.

Why this matters

This tells the browser to send cookies and Authorization headers on cross-origin requests from ANY origin and to expose the authenticated response back to that origin, so any malicious website a logged-in user visits can call this API with their credentials and read the result (CWE-942, Permissive Cross-domain Policy). This is a common AI-generated mistake: anyHost() is used to "make CORS work" while credentials are also enabled.

Never pair anyHost() with credentials. Allow only the specific origins that need credentialed access: allowHost("app.example.com", schemes = listOf("https"))

import io.ktor.server.application.*
import io.ktor.server.plugins.cors.routing.*

fun Application.configureCors() {
    install(CORS) {
        // ruleid: auth.kotlin.cors.anyhost-credentials
        anyHost()
        allowCredentials = true
    }
}

import io.ktor.server.application.*
import io.ktor.server.plugins.cors.routing.*

fun Application.configureCors() {
    install(CORS) {
        allowHost("app.example.com", schemes = listOf("https"))
        allowCredentials = true
    }
}

fun Application.configurePublicCors() {
    // anyHost without credentials is a public, read-only API — out of scope.
    install(CORS) {
        anyHost()
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.kotlin.cors.anyhost-credentials -- <reason>

References