Web-Application with CORS Origin: * using authorization header

Question

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote:

When responding to a credentialed request, the server must specify an origin in the value of the Access-Control-Allow-Origin header, instead of specifying the "*" wildcard.

Because the request headers in the above example include a Cookie header, the request would fail if the value of the Access-Control-Allow-Origin header were "". But it does not fail: Because the value of the Access-Control-Allow-Origin header is "http://foo.example" (an actual origin) rather than the "" wildcard, the credential-cognizant content is returned to the invoking web content.

So if I read this correctly, if the Access-Control-Allow-Origin is set to *. CORS requests can't be accomplished with credentials, so - for example with a Authorization: Bearer 123 header.

This only applies if the request comes from an different origin, than the web-application (SOP). Otherwise it would be impossible for a web-application to use Access-Control-Allow-Origin: * and Authorization: Token 123.

Did I understand this correctly?

Answer 1

Pretty much, yes. The key here is that the browser doesn't pay any attention to the ACAO header for requests to the same domain: therefore you can put anything you like in the ACAO header, and it'll work for your application running on the same domain.

For requests to a different domain, the browser does pay attention to the ACAO header - if the origin is acceptable, it then looks at what other Access-Control headers are included, and takes action based on those (e.g. ignoring authentication headers if there is a wildcard, or no Access-Control-Allow-Credentials: true header)