CORS (Cross-Origin Resource Sharing) is a browser rule that controls which other websites are allowed to call your API from a user's browser. Setting the allowed origin to a wildcard lets any website make those calls. That is fine for a fully public API, but risky when your API relies on cookies or returns data tied to a specific user.
What CORS actually protects
It stops a malicious site the user visits from quietly making authenticated requests to your API using the user's session. The allowed-origin setting is how you say which sites you trust to do that.
When the wildcard bites
If your API authenticates with cookies and you combine a wildcard origin with credentials, a malicious page can make authenticated calls as the victim and read the responses. Browsers block that exact combination, but the underlying misconfiguration still signals an API that has not scoped who can call it. Use an explicit allowlist of your own origins.
What this means for AI-generated code
When asked to fix a CORS error, an AI assistant reaches for the wildcard because it makes the error disappear immediately, without reasoning about which origins should actually be trusted. It resolves the symptom and leaves the API open to any site.
Common questions
Is CORS a security feature or a browser restriction?
Both. CORS is a browser policy that restricts which origins can read cross-site responses. It protects users by preventing a malicious site from quietly calling your API with their cookies. The server controls which origins are trusted by setting the Access-Control-Allow-Origin header.
Does a wildcard CORS origin affect API-key-authenticated requests?
If your API uses API keys or bearer tokens in headers rather than cookies, a wildcard origin is lower risk — the other site still has to have the key. The danger is highest when authentication uses cookies, because the browser sends those automatically on every request regardless of origin.
How do I fix a wildcard CORS origin correctly?
Replace the wildcard with an explicit list of your own origins. In Express: res.setHeader('Access-Control-Allow-Origin', 'https://yourdomain.com'). In Next.js middleware, check the Origin header against a constant allowlist. If you need multiple origins, maintain the list and check dynamically rather than widening to *.