refactor(cors): warn when credentials is used with wildcard options by productdevbook · Pull Request #1323 · h3js/h3

productdevbook · 2026-03-14T16:05:27Z

Summary

The CORS spec prohibits `Access-Control-Allow-Origin: *` (and other wildcard values) when `Access-Control-Allow-Credentials: true` is set — browsers silently reject such responses
The existing JSDoc on `CorsOptions.credentials` already documents this constraint, but there was no runtime validation
Now emits a `console.warn` when `resolveCorsOptions` detects `credentials: true` combined with wildcard (`*`) values for `origin`, `methods`, `allowHeaders`, or `exposeHeaders`
This helps developers catch misconfiguration early instead of debugging silent browser CORS failures

Test plan

All CORS unit tests pass (34/34)
Warning only triggers for explicit misconfiguration, not for correctly configured CORS

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Added a runtime console warning when CORS credentials are enabled while the origin is missing or set to a wildcard ("*"), alerting about potentially insecure/incompatible configurations without changing public APIs.
Tests
- Added unit tests covering warning emission for credential + wildcard/missing origin and absence of warning for specific origins or disabled credentials.

coderabbitai · 2026-03-14T16:05:47Z

📝 Walkthrough

Walkthrough

Adds a runtime console warning in resolveCorsOptions when credentials: true is used together with a wildcard ("*") or missing origin. The function now merges defaults and user options before emitting the warning and returns the merged resolved object. No public signatures changed.

Changes

Cohort / File(s)	Summary
CORS runtime `src/utils/internal/cors.ts`	Reworked `resolveCorsOptions` to build and return a merged resolved options object; emit `console.warn` when `credentials: true` and `origin` is `*` or not provided. No export/signature changes.
Tests `test/unit/cors.test.ts`	Added Vitest tests covering warning behavior: warns for missing/wildcard origin with credentials, and no warn for specific origin or when credentials is false.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I sniffed the CORS, credentials in sight,
A starry origin gave me a fright.
I whispered a warn, then hopped away,
Merge your options, and code will stay. 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Title check	✅ Passed	The title accurately describes the main change: adding a runtime warning when credentials are used with wildcard CORS options.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings (stacked PR)
📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/cors-credentials-wildcard-warn

📝 Coding Plan

Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-03-14T16:06:38Z

Open in StackBlitz

npm i https://pkg.pr.new/h3@1323

commit: 774022a

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/utils/internal/cors.ts`:
- Around line 41-59: The warning inside resolveCorsOptions fires on every
request because handleCors calls it per-request; change it to emit once per
unique misconfiguration by deduplicating warnings at module scope (e.g., add a
module-level WeakSet for seen options objects and/or a Set<string> for
serialized keys) and check that set before calling console.warn; specifically,
in resolveCorsOptions check resolved.credentials and compute a dedupe key from
options.origin, options.methods, options.allowHeaders, options.exposeHeaders (or
use the options object identity in a WeakSet) and only log if that key/object
hasn’t been seen, then add it to the dedupe set so subsequent calls skip the
warning.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f8a39dbc-6cbb-4c66-a9e8-11bb34298977

📥 Commits

Reviewing files that changed from the base of the PR and between c28356e and 11d4104.

📒 Files selected for processing (1)

src/utils/internal/cors.ts

The CORS spec prohibits using Access-Control-Allow-Origin: * (and other wildcard values) when Access-Control-Allow-Credentials: true is set. Browsers silently reject such responses, which is confusing to debug. Now emits a console.warn when resolveCorsOptions detects credentials: true combined with wildcard values for origin, methods, allowHeaders, or exposeHeaders — matching the existing JSDoc documentation on CorsOptions. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Use a module-level WeakSet to track options objects that have already been warned about, so the warning only fires once per unique CorsOptions object instead of on every request. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Address maintainer review: - Remove global WeakSet state (unacceptable) - Remove temporary array allocation (runtime performance) - Use a single compact if condition checking only origin wildcard with credentials (the only combination browsers actually reject) - Add regression tests that fail without the warning and pass with it Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/utils/internal/cors.ts`:
- Around line 41-45: The warning in resolveCorsOptions is emitted on every
request; change behavior by moving validation out of the per-request path and
into a startup-time check or opt-in deduplication: add an optional warnOnce
boolean to CorsOptions and update resolveCorsOptions to only log the warning
when warnOnce is true (and set/track it in the local function scope, not
module-global), or better, extract the validation logic into a new
validateCorsOptions(options: CorsOptions) helper that callers (e.g., startup
code that currently calls resolveCorsOptions) can invoke once; ensure
validateCorsOptions (or the new warnOnce behavior) checks wildcard usage for all
four fields mentioned (origin, methods, allowHeaders, exposeHeaders) and update
handleCors and resolveCorsOptions usages so they no longer emit the warning
per-request; also update docs/comments to state resolveCorsOptions is expected
to be used at startup when possible.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c08031f2-0e51-4d3a-af6a-0743583f22af

📥 Commits

Reviewing files that changed from the base of the PR and between d7d77f3 and 774022a.

📒 Files selected for processing (2)

src/utils/internal/cors.ts
test/unit/cors.test.ts

productdevbook requested a review from pi0 as a code owner March 14, 2026 16:05

coderabbitai Bot reviewed Mar 14, 2026

View reviewed changes

Comment thread src/utils/internal/cors.ts Outdated

pi0 reviewed Mar 14, 2026

View reviewed changes

Comment thread src/utils/internal/cors.ts Outdated

pi0 reviewed Mar 14, 2026

View reviewed changes

Comment thread src/utils/internal/cors.ts Outdated

productdevbook and others added 3 commits March 14, 2026 23:01

productdevbook force-pushed the fix/cors-credentials-wildcard-warn branch from d7d77f3 to 774022a Compare March 14, 2026 20:05

coderabbitai Bot reviewed Mar 14, 2026

View reviewed changes

Comment thread src/utils/internal/cors.ts

pi0 changed the title ~~fix(cors): warn when credentials is used with wildcard options~~ refactor(cors): warn when credentials is used with wildcard options Mar 14, 2026

pi0 approved these changes Mar 14, 2026

View reviewed changes

pi0 merged commit 5da2989 into main Mar 14, 2026
8 checks passed

pi0 deleted the fix/cors-credentials-wildcard-warn branch March 14, 2026 20:35

This was referenced Jul 11, 2026

fix(cors): correct vary handling and credentialed wildcard behavior #1456

Merged

fix(cors): warn on credentials with null origin #1464

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

refactor(cors): warn when credentials is used with wildcard options#1323

refactor(cors): warn when credentials is used with wildcard options#1323
pi0 merged 3 commits into
mainfrom
fix/cors-credentials-wildcard-warn

productdevbook commented Mar 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Mar 14, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

pkg-pr-new Bot commented Mar 14, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

productdevbook commented Mar 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

pkg-pr-new Bot commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

productdevbook commented Mar 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Mar 14, 2026 •

edited

Loading

pkg-pr-new Bot commented Mar 14, 2026 •

edited

Loading