Why is allowedOrigins('*') combined with allowCredentials(true) rejected by browsers?

Allowing every origin to make credentialed (cookie-carrying) requests would let ANY website — including malicious ones — silently issue authenticated requests using a victim's existing session cookie, defeating the entire purpose of CORS as a protective boundary. Browsers enforce that a wildcard origin cannot be combined with credentials; you must list specific allowed origins (or patterns) instead.