Web Security · Middle · Question 37 of 75

A `fetch` sends `credentials: 'include'` to another origin. What else is needed for the browser to expose the response?

1Nothing, credentials always make CORS succeed
2Only Access-Control-Allow-Origin: *
✓Correct answer: Access-Control-Allow-Credentials: true and an exact (not *) Access-Control-Allow-Origin

Explanation

Both headers are needed for credentialed requests. Also, third-party cookie restrictions may stop the cookies being sent at all.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.