Access-Control-Allow-Headers Wildcard: Credentials and Authorization
By Ankit Jain · Updated
Understand when wildcard request-header permission works and why credentials or Authorization require explicit names.
Browser message
Typical wording varies by browser:
Request header field authorization is not allowed by Access-Control-Allow-Headers.
What it means
Access-Control-Allow-Headers: * is not universal permission. With credentials mode include, it is treated as a literal header name; Authorization needs explicit permission regardless.
Evidence to inspect
Check the frontend credentials mode and the actual non-safelisted headers. A token explicitly added as Authorization can trigger this error even when no cookies are involved.
Smallest safe fix
Use an explicit request-header list on the OPTIONS response. Match the approved frontend’s needs, keeping the list small.
Example permission for an approved request (not a complete API policy):
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type, AuthorizationWildcard origin permission has its own credentials restriction. Fixing Allow-Headers does not fix an invalid Allow-Origin. The actual response still needs origin and, for include mode, credential permission.
Verify the fix
Check a JSON request and a token request separately, with the intended credentials mode. Confirm OPTIONS permits their headers and the actual response grants access.
Use the CORS Tester to inspect public API headers or analyze a captured response. Confirm the result from the actual frontend afterward.
Continue learning
Missing request-header permission · Framework configuration · All errors