CORS with access-control-allow-credentials

Question

Am I correct in assuming that setting the 'access-control-allow-credentials True' header, even if you are not including the 'access-control-allow-origin' header is potentially dangerous for a website? My thought here being it still allows attackers to submit requests cross-origin with the creds included, but simply doesn't allow them to view the response?

Answer 1

Your assumption is incorrect. Without Access-Control-Allow-Origin, all the other CORS response headers have zero effect at all.

Your thought is... misleading but not incorrect. You can always submit (simple) requests cross-origin, with credentials, utterly regardless of any CORS headers (including Access-Control-Allow-Credentials). The browser won't even know whether your server will return ACAC (or any other response header) until after the request is sent, because requests are sent before responses are returned.

You are possibly confused by the existence of CORS pre-flight requests, which are sent by the browser before sending the actual request. However, pre-flights are only used for non-simple requests. Broadly speaking, a non-simple request is just any request that can't be sent by an HTML form element. Adding credentials does NOT make a request non-simple; cookies and HTTP Basic/Digest Authorization headers are automatically included with cross-origin form submissions (in fact, there's no way for the client to prevent this), assuming the cookies aren't SameSite (and the browser isn't configured to block third-party cookies). In any case, though, a pre-flight response that contained ACAC: True but no ACAO (or ACAO with a mismatched origin, or ACAO: * and the request was to have included credentials) will result in the actual request just not being sent.