v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.py.fastapi.trusted-host-wildcard

Starlette's TrustedHostMiddleware is added but configured to trust every Host header (allowed_hosts=["*"], or a list that contains "*").

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

The middleware exists specifically to validate the incoming Host/X-Forwarded-Host header against an allow-list; a wildcard disables that check, re-opening Host header injection: password-reset-link poisoning, cache poisoning, and routing of absolute URLs the app builds from the Host (CWE-346). This is a common AI-generated shortcut to silence a host-validation error rather than enumerate the real hostnames.

List the exact hostnames the service answers on, e.g. app.add_middleware(TrustedHostMiddleware, allowed_hosts=["app.example.com", "www.example.com"]) (a leading-dot entry like "*.example.com" matches subdomains and is fine; the problem is the bare "*").

VULNERABLE
vulnerable.py
from fastapi import FastAPI
from starlette.middleware.trustedhost import TrustedHostMiddleware

app = FastAPI()

# ruleid: auth.py.fastapi.trusted-host-wildcard
app.add_middleware(TrustedHostMiddleware, allowed_hosts=["*"])

# Wildcard buried in an otherwise concrete list.
# ruleid: auth.py.fastapi.trusted-host-wildcard
app.add_middleware(
    TrustedHostMiddleware,
    allowed_hosts=["app.example.com", "*"],
)

# Direct instantiation form.
# ruleid: auth.py.fastapi.trusted-host-wildcard
mw = TrustedHostMiddleware(app, allowed_hosts=["*"])
SAFE
safe.py
from fastapi import FastAPI
from starlette.middleware.trustedhost import TrustedHostMiddleware

app = FastAPI()

# Concrete allow-list of hostnames.
# ok: auth.py.fastapi.trusted-host-wildcard
app.add_middleware(
    TrustedHostMiddleware,
    allowed_hosts=["app.example.com", "www.example.com"],
)

# Subdomain wildcard is a valid, scoped allow-list entry (not a bare "*").
# ok: auth.py.fastapi.trusted-host-wildcard
app.add_middleware(
    TrustedHostMiddleware,
    allowed_hosts=["*.example.com", "example.com"],
)

# Hosts sourced from configuration.
# ok: auth.py.fastapi.trusted-host-wildcard
app.add_middleware(TrustedHostMiddleware, allowed_hosts=settings.allowed_hosts)

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.fastapi.trusted-host-wildcard -- <reason>

References

https://www.starlette.io/middleware/#trustedhostmiddleware ↗https://cwe.mitre.org/data/definitions/346.html ↗