Browser & Web Performance · Middle · Question 48 of 75

The frontend sends `fetch(url, { credentials: "include" })` to another origin. What must the response contain?

1Access-Control-Allow-Origin: * only
2Set-Cookie with SameSite=Strict
✓Correct answer: Access-Control-Allow-Origin with the exact origin (not *) and Access-Control-Allow-Credentials: true

Explanation

With credentials the wildcard is not allowed. Also, cookies must be SameSite=None; Secure to be sent cross-site.

Further reading

Test yourself

Take the Browser & Web Performance · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.