CORS misconfiguration: credentials enabled with wildcard allowed origins

[Alexx3890]

Summary

main.py configures CORSMiddleware with both allow_origins=["*"] and allow_credentials=True.

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    allow_methods=["GET", "POST"],
    allow_headers=["*"],
)

Issue

Credentialed CORS responses cannot use Access-Control-Allow-Origin: *. When cross-origin requests include browser-managed credentials such as cookies, browsers require the response to specify an explicit allowed origin.

This configuration is therefore misleading and may cause credentialed cross-origin requests to fail or behave differently from what the configuration appears to intend.

Depending on how Starlette's CORS middleware handles the request, the middleware may return the requesting origin instead of * for requests involving credentials. With allow_origins=["*"], this can effectively allow credentialed requests from arbitrary origins, which may create a larger security risk than an explicit origin allow-list.

Suggested Fix

Choose one configuration based on the intended use case:

If credentials are not required

Keep the wildcard origin and disable credentials:

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=False,
    allow_methods=["GET", "POST"],
    allow_headers=["*"],
)

If credentials are required

Use an explicit allow-list of trusted origins:

app.add_middleware(
    CORSMiddleware,
    allow_origins=[
        "https://example.com",
    ],
    allow_credentials=True,
    allow_methods=["GET", "POST"],
    allow_headers=["*"],
)

Severity

Medium — this is a CORS configuration issue that can either break credentialed cross-origin requests or unintentionally permit broader cross-origin access than intended. The actual security impact depends on whether the application uses browser-managed credentials and exposes sensitive endpoints.