API Design · Middle · Question 67 of 75
Why can't an API respond with Access-Control-Allow-Origin: * to credentialed browser requests?
- ✓Correct answer: Browsers reject the wildcard when cookies or auth are included; the server must echo a specific allowed origin
- 2It works but is slower
- 3The wildcard is invalid syntax
Explanation
Echo only origins from an allow list, and add Vary: Origin so caches don't mix responses for different origins.