// http header · cors header

Access-Control-Allow-Credentials

Whether credentials may be sent

What the Access-Control-Allow-Credentials header does

Access-Control-Allow-Credentials: true lets a cross-origin request include credentials (cookies or HTTP auth). When it's set, Access-Control-Allow-Origin cannot be * — it must name a specific origin.

Example

Access-Control-Allow-Credentials: true

Access-Control-Allow-Credentials in practice

Credentialed CORS response

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: Origin

Common Access-Control-Allow-Credentials questions and problems

What is the only valid value?

true. If credentials must not be allowed, omit the header instead of sending false.

Why do my cookies not get sent cross-origin?

Both sides must opt in: the response needs Access-Control-Allow-Credentials: true and the client must set credentials: "include" (fetch) or withCredentials (XHR). Cookies also need suitable SameSite settings.

Why does the browser reject my wildcard with credentials?

With credentials, Access-Control-Allow-Origin must be a specific origin, and the Allow-Methods and Allow-Headers values cannot be *.

Access-Control-Allow-Credentials vs related headers

Access-Control-Allow-Origin: Allow-Origin names who may read the response; with credentials it must be an exact origin.
Cookie: Cookie is the request header that carries the credentials this header permits.

Where it's used

Access-Control-Allow-Credentials is a cors header. CORS headers govern cross-origin requests — which other origins may read a response.

Other cors headers

Access-Control-Allow-Origin Access-Control-Allow-Methods Access-Control-Allow-Headers Access-Control-Allow-Credentials Access-Control-Max-Age