v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: HIGH auth.ruby.cors.wildcard-origin-with-credentials

A rack-cors allow block combines origins '*' with credentials: true.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

That instructs browsers to send cookies and Authorization headers to a resource that trusts EVERY origin, which is exactly the combination the CORS spec forbids and a CSRF/data-theft primitive (CWE-942). LLM-generated CORS setups routinely pair a wildcard origin with credentials to make cross-site auth "just work".

Decide what the endpoint actually needs:

  • Public, no cookies/auth cross-site -> origins '*' with no credentials: true (the default).
  • Authenticated for a known frontend -> enumerate the exact origins, e.g. origins 'https://app.example.com', and keep credentials: true.

Never combine a wildcard origin with credentials enabled.

VULNERABLE
vulnerable.rb
# frozen_string_literal: true

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins '*'
    # ruleid: auth.ruby.cors.wildcard-origin-with-credentials
    resource '*', headers: :any, methods: [:get, :post], credentials: true
  end
end

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    # ruleid: auth.ruby.cors.wildcard-origin-with-credentials
    resource '/api/*', headers: :any, methods: [:any], credentials: true
    origins "*"
  end
end
SAFE
safe.rb
# frozen_string_literal: true

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  # Wildcard origin but no credentials -> allowed by the spec.
  allow do
    origins '*'
    resource '*', headers: :any, methods: [:get, :post]
  end
end

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  # Credentials but scoped to an explicit origin allow-list.
  allow do
    origins 'https://app.example.com', 'https://admin.example.com'
    resource '*', headers: :any, methods: [:any], credentials: true
  end
end

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.ruby.cors.wildcard-origin-with-credentials -- <reason>

References

https://github.com/cyu/rack-cors#origin ↗https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials ↗