Access-Control-Allow-Origin must not be '*' when the credentials mode is 'include'

You're sending cookies or HTTP auth (fetch(url, {credentials: 'include'}) or axios withCredentials: true), and the server answered Access-Control-Allow-Origin: *. Browsers never allow * with credentials. With credentials, * in Allow-Headers and Allow-Methods is also treated literally.

Fix

Echo the request's Origin only if it is on your allowlist:

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: Origin

Don't reflect every Origin blindly: with credentials, that lets any website read your users' authenticated responses.

Express cors: cors({ origin: ['https://app.example.com'], credentials: true }). FastAPI: allow_origins=[...] (not ["*"]) with allow_credentials=True.

Cross-site cookies also need SameSite=None; Secure.

Want every stack fixed at once? The CORS Fix Kit ($9) includes the cors-doctor CLI plus tested configs for 13 stacks.

Reference

MDN: Cross-Origin Resource Sharing

Independent pages, not affiliated with or endorsed by any vendor mentioned.