Credentials and CORS

Credentialed cross-origin requests include cookies, client TLS certs, or the Authorization header when the front-end sets credentials: 'include' (fetch) or withCredentials (XHR).

Browser rules (simplified)

• Server must send Access-Control-Allow-Credentials: true.
• Access-Control-Allow-Origin must be an explicit origin — not *.
• The ACAO value should match the request’s Origin.

CORSProbe flags the common mismatch of ACAO: * together with ACAC: true, which browsers reject for credentialed flows.

Probe with credentials option