Cors Wildcard in Fiber with Basic Auth

Cross-origin resource sharing (CORS) misconfigurations in Fiber can expose Basic Auth–protected endpoints to unauthorized origins when a wildcard Access-Control-Allow-Origin is combined with credentialed requests. In browsers, requests with credentials (cookies, HTTP authentication) are considered non‑simple. For non‑simple requests, browsers require a preflight (OPTIONS) that validates Access-Control-Allow-Origin against an explicit origin and checks that Access-Control-Allow-Credentials is not set to true when the origin is a wildcard.

To secure a Fiber API that uses Basic Auth, configure CORS with explicit origins and ensure credentials are only allowed where necessary. Below are concrete, working examples in Go using the Fiber framework.

Example 1: Strict CORS with Basic Auth

This example sets specific origins, does not allow credentials globally, and adds selective credential support for a trusted origin.

package main

import (
	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/cors"
)

func main() {
	app := fiber.New()

	// Define allowed origins explicitly
	allowedOrigins := []string{
		"https://app.yourcompany.com",
		"https://staging.yourcompany.com",
	}

	app.Use(cors.New(cors.Config{
		AllowOrigins:     allowedOrigins,
		AllowCredentials: false, // do not allow credentials by default
		AllowHeaders:     "Authorization, Content-Type",
		AllowMethods:     "GET, POST, PUT, DELETE, OPTIONS",
		ExposeHeaders:    "X-Total-Count",
		MaxAge:           3600,
	}));

	// Protected endpoint that uses Basic Auth
	app.Get("/secure/data", func(c *fiber.Ctx) error {
		user, pass, ok := c.BasicAuth()
		if !ok {
			return c.SendStatus(fiber.StatusUnauthorized)
		}
		if user != "admin" || pass != "S3cureP@ss!" {
			return c.SendStatus(fiber.StatusForbidden)
		}
		return c.JSON(fiber.Map{"data": "protected resource"})
	})

	app.Listen(":3000")
}

Example 2: Per-route credentialed CORS for a trusted origin

If a specific origin must send credentials, apply CORS per route and set AllowCredentials only for that route, keeping the global default false.

app.Get("/trusted", func(c *fiber.Ctx) error {
	// Apply per-route CORS with credentials for a single trusted origin
	opts := cors.Config{
		AllowOrigins:     []string{"https://partner.yourcompany.com"},
		AllowCredentials: true,
		AllowHeaders:     "Authorization, Content-Type",
		AllowMethods:     "GET, OPTIONS",
		MaxAge:           3600,
	}
	c.Locals("cors", opts)

	user, pass, ok := c.BasicAuth()
	if !ok {
		return c.SendStatus(fiber.StatusUnauthorized)
	}
	if user != "partner" || pass != "P@ssw0rd!" {
		return c.SendStatus(fiber.StatusForbidden)
	}
	return c.JSON(fiber.Map{"data": "trusted resource"})
})

Why this mitigates the risk

• Access-Control-Allow-Origin is set to explicit origins rather than *, preventing arbitrary origins from reading responses even when credentials are present.
• Access-Control-Allow-Credentials is kept false globally, so browsers will not include cookies or authentication headers for cross-origin requests to wildcard or mismatched origins.
• When credentials are required, CORS is applied per route with a tightly scoped origin and short MaxAge for preflight caching, reducing exposure.
• Basic Auth over HTTPS is enforced; the examples assume TLS termination upstream, ensuring credentials are not transmitted in cleartext.