Avoid permissive FastAPI CORS with credentials
FastAPI `CORSMiddleware` should not combine wildcard origins, methods, or headers with `allow_credentials=True`.
#Metadata
#Why it matters
Wildcard CORS policies plus credentials mirror insecure browser CORS combinations that attackers can abuse from malicious origins.
#Remediation
Replace wildcard origins, methods, and headers with explicit allowlists when credentials are required.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/python/py.security.fastapi-insecure-cors.rule.yaml.