# 运行时错误：CORS：不能将allow_credentials与allow_origins='*'一起使用

- **ID:** `python/fastapi-cors-credentials-error`
- **领域:** python
- **类别:** config_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

FastAPI CORS配置使用了allow_credentials=True和allow_origins=['*']，CORS规范不允许这样做。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 3.x | active | — | — |

## 解决方案

1. **Specify explicit origins instead of wildcard** (95% 成功率)
   ```
   app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://example.com"],
    allow_credentials=True,
)
   ```
2. **Remove allow_credentials if wildcard is needed** (85% 成功率)
   ```
   app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=False,
)
   ```

## 无效尝试

- **Setting allow_credentials to False without changing origins** — May break functionality that requires credentials. (60% 失败率)
- **Ignoring the error and deploying anyway** — CORS errors will occur in the browser. (95% 失败率)