Drop credentials or the wildcard from CORS on Shopify

Why it matters

Browsers refuse Access-Control-Allow-Origin * together with Access-Control-Allow-Credentials true, so the setup does not do what was intended. Public resources need no credentials, and private ones need a fixed list of origins.

The fix

Not possible on Shopify. Shopify sets the storefront's response headers and stores cannot change their CORS policy.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Never allow the null origin in CORS
• Limit CORS to the origins that need it