// http header · cors header
Access-Control-Allow-Credentials
Whether credentials may be sent
What the Access-Control-Allow-Credentials header does
Access-Control-Allow-Credentials: true lets a cross-origin request include credentials (cookies or HTTP auth). When it's set, Access-Control-Allow-Origin cannot be * — it must name a specific origin.
Example
Access-Control-Allow-Credentials: trueWhere it's used
Access-Control-Allow-Credentials is a cors header. CORS headers govern cross-origin requests — which other origins may read a response.
Other cors headers
Access-Control-Allow-Origin Access-Control-Allow-Methods Access-Control-Allow-Headers Access-Control-Allow-Credentials Access-Control-Max-Age