Diego Ekström

ok so if you send cookies or use credentials: 'include', the server cannot use . it must echo the exact origin and send Access Control Allow Credentials: true. Thats why a wildcard sometimes doesnt work.

For your own Express backend, use the cors middleware before your routes: app.use(cors({ origin: 'https://your site.example', credentials: true })). Make suree error responses (401, 500) also go through it; otherwise a real server error…