intermediateCORS: Cross-Origin Resource Sharing
Why is allowedOrigins('*') combined with allowCredentials(true) rejected by browsers?
Allowing every origin to make credentialed (cookie-carrying) requests would let ANY website — including malicious ones — silently issue authenticated requests using a victim's existing session cookie, defeating the entire purpose of CORS as a protective boundary. Browsers enforce that a wildcard origin cannot be combined with credentials; you must list specific allowed origins (or patterns) instead.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response