Cursor's CORS Config Is Wide Open by Default (Here's the Fix)

TL;DR Cursor and Claude Code default to cors() with no arguments -- any website can read your API responses CWE-942 affects Express, Fastify, and FastAPI backends generated without explicit origin config Fix: pass an explicit origin array and set credentials: true ; browsers enforce the restriction for you I reviewed four side projects last week, all vibe-coded with Cursor. Clean structure, decent test coverage, working auth flows. Then I checked the CORS configuration in each one. Every single one had this: app . use ( cors ()); // CWE-942: wildcard CORS origin No origin list. No credentials config. Zero arguments. That defaults to Access-Control-Allow-Origin: * -- any website can read your API responses. Build a page at evil.com that fires a fetch to your endpoint, and the browser returns the full response. One of those projects had user profile endpoints. Another had an /api/admin/users route with no rate limiting. Both were behind open CORS. Neither developer knew it. The Vulnerabl