v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.swift.cors.wildcard-with-credentials

A Vapor CORSMiddleware.Configuration combines allowedOrigin: .all (the * wildcard) with allowCredentials: true.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

This tells browsers to send cookies and Authorization headers to a resource that accepts every origin, which lets any site read authenticated responses on the user's behalf, the classic wildcard-plus-credentials CORS misconfiguration (CWE-942). The browser will actually refuse * with credentials, so AI-generated fixes that "reflect the origin" recreate the same hole against every caller.

Restrict the origin to a known allow-list, e.g. allowedOrigin: .custom("https://app.example.com") (or .any([...])), or set allowCredentials: false if no cookies/credentials are needed.

VULNERABLE
vulnerable.swift
import Vapor

func configureCORS(_ app: Application) {
    // ruleid: auth.swift.cors.wildcard-with-credentials
    let config = CORSMiddleware.Configuration(
        allowedOrigin: .all,
        allowedMethods: [.GET, .POST],
        allowedHeaders: [.authorization, .contentType],
        allowCredentials: true
    )
    app.middleware.use(CORSMiddleware(configuration: config))
}
SAFE
safe.swift
import Vapor

func configureCORS(_ app: Application) {
    // Explicit origin allow-list with credentials.
    let restricted = CORSMiddleware.Configuration(
        allowedOrigin: .custom("https://app.example.com"),
        allowedMethods: [.GET, .POST],
        allowedHeaders: [.authorization, .contentType],
        allowCredentials: true
    )
    app.middleware.use(CORSMiddleware(configuration: restricted))

    // Wildcard origin, but no credentials are sent.
    let publicAPI = CORSMiddleware.Configuration(
        allowedOrigin: .all,
        allowedMethods: [.GET],
        allowedHeaders: [.contentType],
        allowCredentials: false
    )
    app.middleware.use(CORSMiddleware(configuration: publicAPI))
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.swift.cors.wildcard-with-credentials -- <reason>

References

https://docs.vapor.codes/advanced/middleware/ ↗https://cwe.mitre.org/data/definitions/942.html ↗