chrome-devtools-frontend
Version:
Chrome DevTools UI
10 lines (4 loc) • 921 B
Markdown
# Ensure credentialed requests aren’t sent to CORS resources with origin wildcards
A Cross-Origin Resource Sharing (CORS) request was blocked because it was configured to `include` credentials and the `Access-Control-Allow-Origin` response header of the request or the associated [preflight request](issueCorsPreflightRequest) was set to a wildcard `*`. CORS requests may only include credentials for resources where the `Access-Control-Allow-Origin` header isn’t a wildcard.
To fix this issue, ensure that either the request is configured to not include credentials, or change the `Access-Control-Allow-Origin` header of the resource to not be a wildcard.
Note that if an opaque response is sufficient, the request’s mode can be set to `no-cors` to fetch the resource with CORS disabled; that way CORS headers aren’t required but credentials aren’t sent and the response content is inaccessible (opaque).