Why Cursor Keeps Setting CORS to * (And How to Fix It)

TL;DR Wildcard CORS (Access-Control-Allow-Origin: *) shows up in the majority of AI-generated Express backends Cursor defaults to it because most training-data CORS examples skip origin whitelisting entirely Fix: replace origin: '*' with a runtime allowlist function -- five minutes, zero extra dependencies I was reviewing a side project for a friend last week. Express backend, generated almost entirely with Cursor. Clean TypeScript, solid test coverage, auth working correctly. One thing stood out immediately. Every route was open to every domain on the internet. Not because auth was missing. The JWT middleware was fine. But at the top of server.ts: app.use(cors({ origin: '*' })); This line shows up in probably eight out of ten AI-generated Express backends I've looked at. It's not a Cursor failure specifically. It's a training data problem. The StackOverflow answers that taught CORS to a generation of Node developers all used origin: '*' in their examples. They were written to solve "m