The HTTP Access-Control-Allow-Credentials response header tells browsers whether the server allows credentials to be included in cross-origin HTTP requests.
Credentials include cookies, Transport Layer Security (TLS) client certificates, or authentication headers containing a username and password. By default, these credentials are not sent in cross-origin requests, and doing so can make a site vulnerable to Cross-Site Request Forgery (CSRF) attacks.
A client can ask for credentials to be included in cross-site requests in several ways:
fetch(), by setting the credentials option to "include".XMLHttpRequest, by setting the XMLHttpRequest.withCredentials property to true.EventSource(), by setting the EventSource.withCredentials property to true.When credentials are included:
Access-Control-Allow-Credentials header to true, then the real request will include credentials; otherwise, the browser reports a network error.Access-Control-Allow-Credentials header to true, the browser reports a network error.| Header type | Response header |
|---|
Access-Control-Allow-Credentials: truetrueThe server allows credentials to be included in cross-origin HTTP requests. This is the only valid value for this header and is case-sensitive. If you don't need credentials, omit this header entirely rather than setting its value to false.
Allow credentials:
Access-Control-Allow-Credentials: trueUsing fetch() with credentials:
fetch(url, {
credentials: "include",
});Using XMLHttpRequest with credentials:
const xhr = new XMLHttpRequest();
xhr.open("GET", "http://example.com/", true);
xhr.withCredentials = true;
xhr.send(null);