如何将凭证标志设置为false？

Question

Seems like such a simple question but I can't find the answer and so leads me to believe maybe I don't have control of the flag!?

Context:

I'm developing a SignalR hub and client. All works great if (on the signalr site) I set the following in the config:

<system.webServer>
   <httpProtocol>
     <customHeaders>
       <add name="Access-Control-Allow-Origin" value="http://example.com" />
     </customHeaders>
   </httpProtocol>
 </system.webServer>

The problem is that I'd like use the wildcard here.

When I do (ie value="*" ), I get the following error (on the client):

A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true.

I could well be missing something simple here, but I can't find a relevant config entry that would allow me to set the credentials flag.

What I've Tried

<add name="Access-Control-Allow-Credentials" value="false"/>

Didn't seem to make a difference (same error).

Answer 1

I believe your client is submitting credentials. CORS does not allow credentials to be included in a wildcard matching set up.

This question outlines it fairly well.

Edit:

This is an even better answer responding to a similar question and linking to the one I referenced. And furthermore, this will be a good place to read