Drop credentials or the wildcard from CORS

Why it matters

Browsers refuse Access-Control-Allow-Origin * together with Access-Control-Allow-Credentials true, so the setup does not do what was intended. Public resources need no credentials, and private ones need a fixed list of origins.

The fix

1. If the response is public and needs no cookies, remove Access-Control-Allow-Credentials.
2. If other sites must read it with cookies, replace the wildcard with an exact allow-list of origins (see the fix for origin reflection with credentials). Do not switch to echoing the request's Origin.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Never allow the null origin in CORS
• Limit CORS to the origins that need it