django-cors-headers is configured to allow every origin, disabling cross-origin access control.

Why this matters

CORS_ALLOW_ALL_ORIGINS = True (or the legacy CORS_ORIGIN_ALLOW_ALL = True) reflects any site's Origin, so ANY website can make cross-origin requests to your API; combined with credentialed sessions this leaks cookies, tokens and CSRF protections cross-origin (CWE-942, OWASP A05:2021). Set it to False and list trusted origins explicitly, e.g. CORS_ALLOWED_ORIGINS = ["https://app.example.com"].

# django-cors-headers settings in a Django settings module.

# ruleid: auth.py.django.cors-allow-all
CORS_ALLOW_ALL_ORIGINS = True

# Legacy setting name (django-cors-headers < 3.0).
# ruleid: auth.py.django.cors-allow-all
CORS_ORIGIN_ALLOW_ALL = True

# django-cors-headers settings in a Django settings module.

# ok: auth.py.django.cors-allow-all -- allow-all disabled
CORS_ALLOW_ALL_ORIGINS = False

# ok: auth.py.django.cors-allow-all -- legacy setting disabled
CORS_ORIGIN_ALLOW_ALL = False

# ok: auth.py.django.cors-allow-all -- explicit trusted allow-list instead
CORS_ALLOWED_ORIGINS = [
    "https://app.example.com",
    "https://admin.example.com",
]

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.django.cors-allow-all -- <reason>

References