AI-Generated APIs Keep Shipping Wildcard CORS. Here's the Fix.

TL;DR Cursor, Claude Code, and Copilot consistently generate Access-Control-Allow-Origin: * in new Express and FastAPI projects Wildcard CORS combined with cookie auth opens your API to cross-origin attacks from any website on the internet Fix: swap the wildcard for an explicit origin allowlist -- takes about two minutes I was reviewing a friend's side project last week. Node/Express backend, Cursor-generated, looked clean. Then I spotted it buried in the middleware setup: app.use(cors()); No options. Default wildcard. That one line means any website can make requests to his API from a visitor's browser. He was planning to add user accounts the following week. This isn't a one-off. I've looked through dozens of vibe-coded repos. The pattern shows up constantly. The AI isn't wrong by its training data standards -- cors() with no arguments is the first result in every Express tutorial from 2019. It learned the pattern without learning the context it was written for. The Vulnerable Patter