Access-Control-Allow-Credentials
Indicates whether the response to a credentialed cross-origin request can be exposed to JavaScript.
Syntax
Access-Control-Allow-Credentials: trueExample
Access-Control-Allow-Credentials: trueDescription
The Access-Control-Allow-Credentials response header tells browsers whether the response to a cross-origin request with credentials (cookies, HTTP auth, client-side certificates) can be exposed to JavaScript.
When set to true, the Access-Control-Allow-Origin header must specify an explicit origin (not *), otherwise the browser will block the response.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
3.4%
(17 of 503) send Access-Control-Allow-Credentials.
Most common values:
true— 15 sitesfalse— 2 sites
See it on: aliexpress.com, etsy.com, forbes.com, paypal.com, crisp.chat
Check if your website sends this header correctly
Check your headers →