security config_error ai_generated true

Access-Control-Allow-Origin cannot be wildcard when credentials flag is true

ID: security/cors-wildcard-credentials

Also available as: JSON · Markdown
88%Fix Rate
85%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Browsers reject CORS responses with Access-Control-Allow-Origin: * when credentials are included.

generic

Workarounds

  1. 90% success Dynamically set Allow-Origin to the requesting origin after validation 
    origin = req.headers.origin; if origin in ALLOWED: set header
  2. 88% success Use a CORS middleware that handles origin reflection 
    cors({ origin: ["https://app.example.com"], credentials: true })

Dead Ends

Common approaches that don't work:

  1. Set Access-Control-Allow-Origin to * with credentials 95% fail

    Browsers explicitly block this combination per spec.

  2. Remove credentials mode to use wildcard 80% fail

    Breaks authentication - cookies and auth headers will not be sent.