As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote:
When responding to a credentialed request, the server must specify an origin in the value of the Access-Control-Allow-Origin header, instead of specifying the "*" wildcard.
Because the request headers in the above example include a Cookie header, the request would fail if the value of the Access-Control-Allow-Origin header were "". But it does not fail: Because the value of the Access-Control-Allow-Origin header is "http://foo.example" (an actual origin) rather than the "" wildcard, the credential-cognizant content is returned to the invoking web content.
So if I read this correctly, if the
Access-Control-Allow-Origin is set to
*. CORS requests can't be accomplished with credentials, so - for example with a
Authorization: Bearer 123 header.
This only applies if the request comes from an different origin, than the web-application (SOP). Otherwise it would be impossible for a web-application to use
Access-Control-Allow-Origin: * and
Authorization: Token 123.
Did I understand this correctly?