Drop credentials or the wildcard from CORS on Apache

Why it matters

Browsers refuse Access-Control-Allow-Origin * together with Access-Control-Allow-Credentials true, so the setup does not do what was intended. Public resources need no credentials, and private ones need a fixed list of origins.

The fix

1. Remove the Header line that sets Access-Control-Allow-Credentials, or drop the application's copy with Header onsuccess unset Access-Control-Allow-Credentials and Header always unset Access-Control-Allow-Credentials, then reload.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Never allow the null origin in CORS
• Limit CORS to the origins that need it