no-missing-cors-check
Detects missing CORS validation (wildcard CORS, missing origin check)
Deprecated. Use
no-permissive-corsinstead.
Status: 🚫 Deprecated — replaced by no-permissive-cors
CWE: CWE-346
Why this rule was replaced
Its detection surface converged with no-permissive-cors, which models the
same misconfigurations (wildcard origins, reflected origins, missing
validation) with fewer false positives and clearer per-finding messages.
Maintaining both meant every improvement had to land twice.
The rule id still resolves so existing configs keep working, but it receives no new detection work. Reports carry the same CWE metadata as before.
Migration
// eslint.config.js
{
rules: {
// before
'express-security/no-missing-cors-check': 'error',
// after
'express-security/no-permissive-cors': 'error',
},
}No source changes are needed — only the rule id in your config.
Options
| Option | Type | Default | Description |
|---|---|---|---|
allowInTests | boolean | false | Allow missing CORS checks in test files |
trustedLibraries | string[] | [] | Custom CORS libraries to trust (wildcard origins in these libraries will not be reported) |
ignorePatterns | string[] | [] | Additional safe patterns to ignore |
Related Rules
no-permissive-cors— the maintained replacement
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.