v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.nestjs.cors-wildcard-credentials

NestJS app.enableCors() is configured with a wildcard/reflected origin (origin: '*' or origin: true) together with credentials: true.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

The CORS spec forbids Access-Control-Allow-Origin: * with credentials, so origin: true echoes the caller's origin back instead, effectively allowing credentialed cross-site requests from ANYWHERE. That is a CSRF / account-takeover primitive.

Enumerate the exact trusted origins instead: app.enableCors({ origin: ['https://app.example.com'], credentials: true }). If the API is public and needs no cookies or auth headers, keep credentials at its default false.

VULNERABLE
vulnerable.ts
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);

  // ruleid: auth.nestjs.cors-wildcard-credentials
  app.enableCors({ origin: '*', credentials: true });

  const app2 = await NestFactory.create(AppModule);
  // ruleid: auth.nestjs.cors-wildcard-credentials
  app2.enableCors({ credentials: true, origin: true });

  await app.listen(3000);
}
bootstrap();
SAFE
safe.ts
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);

  // ok: auth.nestjs.cors-wildcard-credentials -- explicit allowlist + credentials
  app.enableCors({
    origin: ['https://app.example.com', 'https://admin.example.com'],
    credentials: true,
  });

  const app2 = await NestFactory.create(AppModule);
  // ok: auth.nestjs.cors-wildcard-credentials -- public API, credentials stays off
  app2.enableCors({ origin: '*' });

  const app3 = await NestFactory.create(AppModule);
  // ok: auth.nestjs.cors-wildcard-credentials -- single trusted origin string
  app3.enableCors({ origin: 'https://app.example.com', credentials: true });

  await app.listen(3000);
}
bootstrap();

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.nestjs.cors-wildcard-credentials -- <reason>

References

https://docs.nestjs.com/security/cors ↗https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials ↗