As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote:

When responding to a credentialed request, the server must specify an origin in the value of the Access-Control-Allow-Origin header, instead of specifying the "*" wildcard.

Because the request headers in the above example include a Cookie header, the request would fail if the value of the Access-Control-Allow-Origin header were "". But it does not fail: Because the value of the Access-Control-Allow-Origin header is "http://foo.example" (an actual origin) rather than the "" wildcard, the credential-cognizant content is returned to the invoking web content.

So if I read this correctly, if the Access-Control-Allow-Origin is set to *. CORS requests can't be accomplished with credentials, so - for example with a Authorization: Bearer 123 header.

This only applies if the request comes from an different origin, than the web-application (SOP). Otherwise it would be impossible for a web-application to use Access-Control-Allow-Origin: * and Authorization: Token 123.

Did I understand this correctly?


Pretty much, yes. The key here is that the browser doesn't pay any attention to the ACAO header for requests to the same domain: therefore you can put anything you like in the ACAO header, and it'll work for your application running on the same domain.

For requests to a different domain, the browser does pay attention to the ACAO header - if the origin is acceptable, it then looks at what other Access-Control headers are included, and takes action based on those (e.g. ignoring authentication headers if there is a wildcard, or no Access-Control-Allow-Credentials: true header)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.