AI-Generated APIs Keep Shipping Wildcard CORS...

TL;DR Cursor, Claude Code, and Copilot consistently generate Access-Control-Allow-Origin: * in new Express and FastAPI projects Wildcard CORS combined with cookie auth opens your API to cross-origin attacks from any website on the internet Fix: swap the wildcard for an explicit origin allowlist -- takes about two minutes I was reviewing a friend's side project last week. Node/Express backend, Cursor-generated, looked clean. Then I spotted it buried in the middleware setup: app.use(cors()); No op