CORS · Response header
Access-Control-Allow-Credentials
Whether cookies and Authorization can be sent cross-origin.
What is Access-Control-Allow-Credentials?
When set to `true`, the browser will include cookies and TLS client certs on cross-origin requests. Must be combined with a specific Access-Control-Allow-Origin (not `*`).
Typical usage
Set to true on responses that require user session cookies cross-origin.
Examples
Access-Control-Allow-Credentials: trueCommon gotchas
Combined with Access-Control-Allow-Origin: *, the browser will refuse the response. Always specify a concrete origin when credentials: true.
Frequently asked questions
What is the Access-Control-Allow-Credentials HTTP header?
When set to `true`, the browser will include cookies and TLS client certs on cross-origin requests. Must be combined with a specific Access-Control-Allow-Origin (not `*`).
Is Access-Control-Allow-Credentials a request or response header?
Access-Control-Allow-Credentials is a response header — the server sends it to the client. Set to true on responses that require user session cookies cross-origin.
What does a Access-Control-Allow-Credentials header look like?
A typical Access-Control-Allow-Credentials header looks like: Access-Control-Allow-Credentials: true.
What are common mistakes with Access-Control-Allow-Credentials?
Combined with Access-Control-Allow-Origin: *, the browser will refuse the response. Always specify a concrete origin when credentials: true.
Related headers
Access-Control-Allow-Origin
Which origins may read this response cross-origin.
Access-Control-Allow-Methods
Which HTTP methods are allowed on the cross-origin resource.
Access-Control-Allow-Headers
Which request headers may be used in the actual cross-origin request.
Access-Control-Max-Age
How long the browser may cache the preflight response.
Origin
The origin (scheme + host + port) of the request.