Web Security · Junior · Question 43 of 75
Why can't a server respond with Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true?
- ✓Correct answer: Browsers forbid this combination, because it would let any site read responses made with the user's cookies
- 2Because
*only works for images - 3Because credentials can only be sent with
GET
Explanation
With credentials the server has to name the exact allowed origin. It should check the Origin against an allowlist, not just echo it back.