v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.php.cors.wildcard-with-credentials

This endpoint sends Access-Control-Allow-Credentials: true together with an Access-Control-Allow-Origin that is either the wildcard * or the request's own Origin reflected back unchecked.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

That combination lets any website make credentialed cross-origin requests and read the response, leaking the victim's session / OAuth tokens cross-origin (CWE-942), an account-takeover primitive. AI-generated code pairs these two headers to "make the browser call work" without an origin allowlist.

Echo the origin only after checking it against a trusted allowlist, e.g. if (in_array($origin, $allowed, true)) { header('Access-Control-Allow-Origin: ' . $origin); header('Access-Control-Allow-Credentials: true'); }

VULNERABLE
vulnerable.php
<?php

function cors_wildcard()
{
    // ruleid: auth.php.cors.wildcard-with-credentials
    header('Access-Control-Allow-Origin: *');
    header('Access-Control-Allow-Credentials: true');
}

function cors_reflected()
{
    // ruleid: auth.php.cors.wildcard-with-credentials
    header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
    header('Access-Control-Allow-Credentials: true');
}
SAFE
safe.php
<?php

function cors_allowlisted()
{
    $origin = $_SERVER['HTTP_ORIGIN'];
    // ok: origin echoed back only after an allowlist check
    if (in_array($origin, ['https://app.example.com'], true)) {
        header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
        header('Access-Control-Allow-Credentials: true');
    }
}

function cors_origin_only()
{
    // ok: wildcard origin without credentials is not credentialed CORS
    header('Access-Control-Allow-Origin: *');
}

function cors_explicit_with_credentials()
{
    // ok: a single explicit origin (not wildcard, not reflected) with credentials
    header('Access-Control-Allow-Origin: https://app.example.com');
    header('Access-Control-Allow-Credentials: true');
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.php.cors.wildcard-with-credentials -- <reason>

References

https://developer.mozilla.org/docs/Web/HTTP/CORS ↗https://cwe.mitre.org/data/definitions/942.html ↗