# RuntimeError: CORS: Cannot use allow_credentials with allow_origins='*'

- **ID:** `python/fastapi-cors-credentials-error`
- **Domain:** python
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

FastAPI CORS configuration uses allow_credentials=True with allow_origins=['*'], which is not allowed by the CORS specification.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **Specify explicit origins instead of wildcard** (95% success)
   ```
   app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://example.com"],
    allow_credentials=True,
)
   ```
2. **Remove allow_credentials if wildcard is needed** (85% success)
   ```
   app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=False,
)
   ```

## Dead Ends

- **Setting allow_credentials to False without changing origins** — May break functionality that requires credentials. (60% fail)
- **Ignoring the error and deploying anyway** — CORS errors will occur in the browser. (95% fail)