Access-Control-Allow-Credentials Must Be true: Diagnose the Response
By Ankit Jain · Updated
Fix missing or invalid credential permission for include-mode requests without confusing CORS with cookie eligibility.
Browser message
Typical wording varies by browser:
The Access-Control-Allow-Credentials value must be true when credentials mode is include.
What it means
The response did not grant credentialed access. The only affirmative value is the case-sensitive token true. false, True, and a missing header do not grant permission.
Evidence to inspect
Check the actual response, including 401 and 500 responses. If OPTIONS is required, inspect its credential permission too. Confirm no middleware or CDN removed or duplicated the header.
Smallest safe fix
For an approved authenticated frontend, send the exact origin and Access-Control-Allow-Credentials: true. If credentialed access is not supported, omit this response header and configure the frontend’s request accordingly.
Example permission for an approved request (not a complete API policy):
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: OriginDo not enable credentials for every reflected Origin. An approved-origin policy belongs on the server. JavaScript cannot fix an absent response permission by adding an Allow-Credentials request header.
Verify the fix
Test the intended frontend using include mode and inspect both responses when preflight is required. Then verify cookie eligibility and authentication as separate checks.
Use the CORS Tester to inspect public API headers or analyze a captured response. Confirm the result from the actual frontend afterward.
Continue learning
Credentials, cookies, and fetch defaults · Framework configuration · All errors