在Socket.io中为XMLHttpRequest设置withCredentials属性

Question

I'm getting the following error using socket.io

XMLHttpRequest cannot load https://******:3000/socket.io/?
EIO=3&transport=polling&t=LPBFdGH. A wildcard '*' cannot be used in the 'Access-Cont
rol-Allow-Origin' header when the credentials flag is true. 
Origin 'https://*****.com' is therefore not allowed 
access. The credentials mode of an XMLHttpRequest is controlled by the 
withCredentials attribute

I've used CORS to set the attribute to no avail.

app.use(cors({ origin: true, credentials: true }));

Are there are any other methods?

Answer 1

A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true.

The key point here is that the origin:true part of your CORS configuration produces a * value for the Access-Control-Allow-Origin header. This is not acceptable when using the withCredentials attribute for the XHR request in socket.io.

You need to explicitly allow the origin, for example like this:

app.use(cors({ origin: 'https://******.com', credentials: true }));