CORS (Cross-Origin Resource Sharing) is a browser rule that controls which other websites are allowed to call your API from a user's browser. Setting the allowed origin to a wildcard lets any website make those calls. That is fine for a fully public API, but risky when your API relies on cookies or returns data tied to a specific user.
What CORS actually protects
It stops a malicious site the user visits from quietly making authenticated requests to your API using the user's session. The allowed-origin setting is how you say which sites you trust to do that.
When the wildcard bites
If your API authenticates with cookies and you combine a wildcard origin with credentials, a malicious page can make authenticated calls as the victim and read the responses. Browsers block that exact combination, but the underlying misconfiguration still signals an API that has not scoped who can call it. Use an explicit allowlist of your own origins.
What this means for AI-generated code
When asked to fix a CORS error, an AI assistant reaches for the wildcard because it makes the error disappear immediately, without reasoning about which origins should actually be trusted. It resolves the symptom and leaves the API open to any site.