TL;DR
AI editors keep generating CORS middleware that reflects the request's Origin header back verbatim while also allowing credentials, so any site on the internet can make authenticated calls to your API and read the response
It passes local testing because reflecting the origin "just works" for every dev port and tool, so nobody notices until a scanner or a pentest catches it (CWE-942)
The fix is a hardcoded allowlist checked against each request's Origin, never a reflection of whatever the browser sends
I hit a CORS error in a side project last week. Frontend on one port, API on another, browser blocking the request. I asked Cursor to fix it, and it did, instantly. The error went away. I moved on to the actual feature I was building.
