Fix cross-origin policy accepts any origin in TanStack Start

The CORS configuration accepts requests from any origin. Combined with credentials this lets any site a logged-in user visits make authenticated calls to the API and read the responses. Without credentials it may be intentional for a public API - the finding says which case it found.

medium likely TanStack Start CWE-942 / OWASP A05:2021

The vulnerable pattern in TanStack Start

MEDIUM likely Cross-origin policy accepts any origin A05:2021 app/routes/api/session.ts:23:3 21 │ const headers = new Headers() 22 │ // cors-permissive: wildcard origin AND credentials, hand-rolled. 23 │ headers.set('access-control-allow-origin', '*') │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ accepts requests from any origin 24 │ headers.set('access-control-allow-credentials', 'true')

This finding comes from the TanStack Start fixture in the owlwarden test suite. Any origin may call this API and read the response. That is a deliberate choice for a public endpoint and a mistake for anything behind a session - nothing in the source says which this is, so it is reported for you to decide.

The corrected handler

Name the origins where you set the header, and vary on Origin so a cache cannot serve one caller's response to another.

const ALLOWED = new Set(['https://app.example.com'])
const origin = request.headers.get('origin') ?? ''
if (ALLOWED.has(origin)) {
  headers.set('Access-Control-Allow-Origin', origin)
  headers.append('Vary', 'Origin')
}

If you are not using TanStack Start

Replace the wildcard with the origins that actually need access, and only send credentials to those.

Check your own repository

npx owlwarden scan
npx owlwarden explain cors-permissive

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other TanStack Start checks

Rules with a tested TanStack Start example.

cors-permissive for every framework / All rules / owlwarden