python network_error ai_generated true

Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

ID: python/fastapi-cors-preflight-credentials

Also available as: JSON · Markdown · 中文
80%Fix Rate
88%Confidence
0Evidence
2024-09-21First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
0.100.x active — — —
0.110.x active — — —

Root Cause

CORSMiddleware configured with allow_origins=['*'] and allow_credentials=True simultaneously.

generic

中文

CORSMiddleware同时配置了allow_origins=['*']和allow_credentials=True。

Workarounds

  1. 95% success 
    app.add_middleware(CORSMiddleware, allow_origins=['https://app.example.com'], allow_credentials=True)
  2. 92% success 
    app.add_middleware(CORSMiddleware, allow_origin_regex=r'https://.*\.example\.com', allow_credentials=True)

Dead Ends

Common approaches that don't work:

  1. 70% fail

    Breaks cookie/auth flows that require credentials.

  2. 85% fail

    Browsers still enforce the CORS check client-side.