Am I correct in assuming that setting the 'access-control-allow-credentials True' header, even if you are not including the 'access-control-allow-origin' header is potentially dangerous for a website? My thought here being it still allows attackers to submit requests cross-origin with the creds included, but simply doesn't allow them to view the response?

1 Answer 1


Your assumption is incorrect. Without Access-Control-Allow-Origin, all the other CORS response headers have zero effect at all.

Your thought is... misleading but not incorrect. You can always submit (simple) requests cross-origin, with credentials, utterly regardless of any CORS headers (including Access-Control-Allow-Credentials). The browser won't even know whether your server will return ACAC (or any other response header) until after the request is sent, because requests are sent before responses are returned.

You are possibly confused by the existence of CORS pre-flight requests, which are sent by the browser before sending the actual request. However, pre-flights are only used for non-simple requests. Broadly speaking, a non-simple request is just any request that can't be sent by an HTML form element. Adding credentials does NOT make a request non-simple; cookies and HTTP Basic/Digest Authorization headers are automatically included with cross-origin form submissions (in fact, there's no way for the client to prevent this), assuming the cookies aren't SameSite (and the browser isn't configured to block third-party cookies). In any case, though, a pre-flight response that contained ACAC: True but no ACAO (or ACAO with a mismatched origin, or ACAO: * and the request was to have included credentials) will result in the actual request just not being sent.

  • Thanks for clearing this up for me.
    – Fresh
    Apr 23, 2021 at 14:59
  • That said, I'd still remove Access-Control-Allow-Credentials: true from the response, if only for defence in depth. If the application has a flaw that allows attackers to inject a single response header (via a query parameter, perhaps) in responses to both the preflight and actual requests, injecting Access-Control-Allow-Origin: https://attacker.com would be enough to turn this into a bona fide CORS misconfiguration.
    – jub0bs
    Dec 30, 2021 at 10:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .