Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

Question

I always thought CORS restrictions was to disable the following scenario:

I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/feed.

BUT

I am trying to send a GET request from my http://shop.domain.com to MY http://www.domain.com/api/accounts/me with javascript, because I want to share some user information to my shop. shop.domain.com is shopify so I can't put any backend code to this subdomain.

I got this error:

Access to XMLHttpRequest at 'https://www.domain.com/api/accounts/me' from origin 'https://shop.domain.com' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

my API returns Access-Control-Allow-Origin: * and I STILL cannot post credentials. so what is the use case for Access-Control-Allow-Origin: *? I can understand why it's not working but What am I protected from if this header is not present.

What change does this header bring at all?

also my cookies are domain-wide but HTTP only, so JS on the shop.domain.com cannot just extract my session id.

Answer 1

The use case of Access-Control-Allow-Origin: * is to allow cross-origin XHR from any domain. This can be useful for some public API.

But in case a site requires a user to first log in and then keep the user authenticated using session cookies (or basic authentication), XHR within this session (i.e. with credentials) is usually only expected to be same-domain or in some cases cross-origin but only from selected domains. Cross-origin XHR from arbitrary domains which includes credentials is very likely a fatal misconfiguration. To make the most obvious case of such misconfiguration impossible the combination of Access-Control-Allow-Origin: * and withCredentials=true will fail. If you want cross-origin XHR with credentials you need to explicitly specify the origins which are allowed to do this kind of sensitive access instead of just using a wildcard.

See also MDN: Request with credentials.