Why Cursor Keeps Writing Wildcard CORS Into Your Express APIs

TL;DR Cursor generates cors({ origin: '*' }) on nearly every Express app it builds Wildcard CORS + Bearer tokens in localStorage means any site can make authenticated requests on behalf of your users One-line fix: replace '*' with an explicit origin allowlist I was reviewing a side project last week. A Node/Express REST API built almost entirely with Cursor. The developer was sharp. The code was clean. The CORS config was a disaster. Every single endpoint was configured with app.use(cors({ origin: '*' })) . The app handled user accounts, subscription data, and a connected Stripe integration. Wide open to any origin on the internet. I've seen this exact pattern in a dozen Cursor-generated projects now. It's not a Cursor bug. It's a training data problem. The Vulnerable Code (CWE-942) Here's what Cursor produces when you ask it to add CORS to an Express app: const express = require ( ' express ' ); const cors = require ( ' cors ' ); const app = express (); app . use ( cors ({ origin : '