Credentialed CORS Request Rejected: Origin and Cookies
By Ankit Jain · Updated
Fix wildcard origin permission for credentials mode include, then check cookies and authentication separately.
Browser message
Typical wording varies by browser:
The Access-Control-Allow-Origin value must not be wildcard when credentials mode is include.
What it means
The browser will not expose a cross-origin response to an include-mode request with wildcard origin permission. This applies even if no eligible cookie was actually sent.
Evidence to inspect
Check whether fetch uses credentials: include or XMLHttpRequest uses withCredentials = true. Inspect the actual response’s origin and credentials permission. Credentials alone do not require OPTIONS.
Smallest safe fix
Choose whether the endpoint needs browser credentials. For an authenticated cookie API, keep include mode and return the exact approved origin plus credential permission. For a public API with no cookie session, omit credential inclusion.
Example permission for an approved request (not a complete API policy):
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: OriginThese headers allow response access; they do not make a cookie eligible. SameSite, Secure, domain, path, expiration, and browser third-party cookie restrictions still apply. CORS permission is not authentication or CSRF protection.
Verify the fix
From the real frontend, inspect whether a cookie is present on the actual request. Confirm unauthorized requests remain unauthorized and their statuses are readable when permitted.
Use the CORS Tester to inspect public API headers or analyze a captured response. Confirm the result from the actual frontend afterward.
Continue learning
The primary credentials and cookies guide · Framework configuration · All errors