CORS Credentials and Exposed Headers

CORS controls whether browser JavaScript may read a cross-origin response and whether credentials are included.

Use Access-Control-Allow-Credentials for credentialed requests, never combine it with a wildcard origin, and list non-safelisted response fields in Access-Control-Expose-Headers.

httpcorscookiesbrowser

Reference (http)

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: ETag

Use Access-Control-Allow-Credentials for credentialed requests, never combine it with a wildcard origin, and list non-safelisted response fields in Access-Control-Expose-Headers.

Common mistakes

Assuming a server-to-server request is blocked by CORS or exposing credentials to every origin.

Sources

MDN HTTP Reference
MDN Using HTTP Cookies
MDN CORS Guide