TL;DR



AI assistants routinely generate CORS configs that allow any origin to read credentialed responses
This is exploitable from any attacker-controlled website, no phishing required
Fix: whitelist origins explicitly and never combine wildcard origins with credentials


I was reviewing a side project last month - a small Express API a friend...