security cors ai_generated true

CORS request with credentials fails: 'Access-Control-Allow-Origin' cannot be wildcard when credentials flag is true

ID: security/cors-wildcard-with-credentials

Also available as: JSON · Markdown
92%Fix Rate
95%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

When a request includes credentials (cookies, auth headers), the CORS response MUST specify the exact origin, not '*'. Browsers reject wildcard Allow-Origin with credentials. This catches nearly every developer setting up CORS for the first time.

generic

Workarounds

  1. 95% success Echo the request Origin header back as Allow-Origin after validating it 
    origin = request.headers['Origin']; if origin in ALLOWED_ORIGINS: response.headers['Access-Control-Allow-Origin'] = origin
  2. 92% success Always include Vary: Origin when reflecting origin to prevent CDN cache poisoning 
    response.headers['Vary'] = 'Origin'  # critical if response passes through CDN or cache
  3. 88% success Use a CORS library that handles origin validation correctly 
    Flask-CORS, django-cors-headers, cors (Express) - all handle origin reflection and Vary header automatically

Dead Ends

Common approaches that don't work:

  1. Set Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true 95% fail

    Browsers explicitly reject this combination. The spec forbids wildcard origin with credentials to prevent credential leaking to arbitrary origins.

  2. Remove Allow-Credentials header to make wildcard work 85% fail

    Without credentials, cookies and auth headers are not sent. Authenticated API calls fail silently with 401.