angular - 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include' - TagMerge
2'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include''Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'

'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'

Asked 1 years ago
0
2 answers

Try using following configuration:

app.use(function(req, res, next) {
  res.header("Access-Control-Allow-Credentials", true);
  res.header("Access-Control-Allow-Origin", req.headers.origin);
  res.header("Access-Control-Allow-Methods", "GET,PUT,POST,DELETE");
  res.header(
    "Access-Control-Allow-Headers",
    "X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept"
  );
  if ("OPTIONS" == req.method) {
    res.send(200);
  } else {
    next();
  }
});

Source: link

0

or If you are using CORS middleware and you want to send withCredentials boolean true (for example sending responses with set-cookie headers) , you can configure CORS like this:

const corsOptions = {
  origin: ["http://localhost:3000"],
 //update: or "origin: true," if you don't wanna add a specific one
  credentials: true,
};
app.use(cors(corsOptions));
  • for using credentials app.use(corse()) won't work, you should specify your specific origin(s) in corsOptions.

it is (somehow) equal to setting the response headers like this:

app.all("*", function (req, res, next) {
  res.header("Access-Control-Allow-Origin", "http://localhost:3000");
  res.header("Access-Control-Allow-Credentials", true);
  res.header("Access-Control-Allow-Methods", "PUT, GET, POST, DELETE, OPTIONS");
  res.header("Access-Control-Allow-Headers", "Content-Type");
  next();
});

Source: link

Recent Questions on angular

    Programming Languages