CORS Dynamic Origin Whitelist & Credentials Misconfiguration Defense

--- description: CORS Dynamic Origin Whitelist & Credentials Misconfiguration Defense - Web security standard for Cross-Origin Resource Sharing (CWE-942). Mandates validating Origin headers against an explicit domain whitelist, strictly forbids returning Access-Control-Allow-Origin: * when Access-Control-Allow-Credentials: true is set, and prevents origin reflection attacks that leak authenticated session cookies. globs: **/cors*.ts, **/main.py, **/server.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cors-wildcard-credentials-vulnerability" --- # CORS Dynamic Origin Whitelist & Credentials Misconfiguration Defense > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: AI writes origin: true or reflects the incoming Origin header back into Access-Control-Allow-Origin, completely defeating cross-origin browser isolation. ## System Constraints You are a Web Browser Security Specialist. NEVER configure CORS middleware to dynamically reflect the incoming Origin header (origin: true or req.headers.origin) when credentials: true is enabled. This misconfiguration allows any malicious website visited by an authenticated user to steal private account data and API responses via cross-origin JavaScript requests. ## Strict Guidelines - MUST define an explicit array of authorized origin domains: ['https://app.example.com', 'https://admin.example.com']. - MUST NOT reflect arbitrary req.headers.origin values back into Access-Control-Allow-Origin. - MUST NOT return Access-Control-Allow-Origin: * when credentials are supported. - MUST configure Access-Control-Max-Age: 86400 to cache preflight OPTIONS responses. - MUST restrict Access-Control-Allow-Headers strictly to required headers (Content-Type, Authorization, Idempotency-Key). ## Bad vs Good Implementations ### Strict CORS Whitelist with Credentials in Express #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Reflecting the incoming origin header back to the browser while enabling credentials allows malicious third-party websites to make credentialed requests and read private user data. ```typescript // FATAL: Dynamic origin reflection with credentials allows cross-site data theft import cors from 'cors'; app.use(cors({ // VULNERABLE: Reflects ANY origin header sent by attacker website! origin: (origin, callback) => callback(null, true), credentials: true, // Allows attacker.com to read authenticated session responses! })); ``` #### Production Standard (Correct) > **Standard**: Validates incoming origins against an immutable Set whitelist. Malicious origins are rejected, ensuring that authenticated session cookies can only be leveraged by authorized domain frontends. ```typescript import cors from 'cors'; const ALLOWED_ORIGINS = new Set([ 'https://app.example.com', 'https://staging.example.com', ]); export const safeCorsMiddleware = cors({ origin: (origin, callback) => { // Allow requests with no origin (like mobile apps or curl) if (!origin) return callback(null, true); if (ALLOWED_ORIGINS.has(origin)) { return callback(null, true); } return callback(new Error('Blocked by CORS policy: Unauthorized Origin'), false); }, credentials: true, maxAge: 86400, // 24 hours preflight cache methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'], allowedHeaders: ['Content-Type', 'Authorization', 'Idempotency-Key'], }); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: CORS Dynamic Origin Whitelist & Credentials Misconfiguration Defense

CORS Dynamic Origin Whitelist & Credentials Misconfiguration Defense defines an industrial-grade behavioral standard for security engineering. Web security standard for Cross-Origin Resource Sharing (CWE-942). Mandates validating Origin headers against an explicit domain whitelist, strictly forbids returning Access-Control-Allow-Origin: * when Access-Control-Allow-Credentials: true is set, and prevents origin reflection attacks that leak authenticated session cookies. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: AI writes origin: true or reflects the incoming Origin header back into Access-Control-Allow-Origin, completely defeating cross-origin browser isolation. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	AI writes origin: true or reflects the incoming Origin header back into Access-Control-Allow-Origin, completely defeating cross-origin browser isolation.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

MUST define an explicit array of authorized origin domains

MUST define an explicit array of authorized origin domains: ['https://app.example.com', 'https://admin.example.com'].

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.