Why Cursor Keeps Generating Wildcard CORS Headers in Your API

«TL;DR AI editors keep generating CORS middleware that reflects the request's Origin header back verbatim while also allowing credentials, so any site on the internet can make authenticated calls to your API and read t...»