如果 CORS 标头“Access-Control-Allow-Origin”为“*”，则不支持凭据

Question

My application do some REST request in a java web application. the requests are CORS requests so the browser do every time an OPTION preflight before the real one. Each request are similar to

Host: localhost:8080 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9, / ;q=0.8 Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Access-Control-Request-Method: GET Access-Control-Request-Headers: iv-groups,iv-user,x-xsrf-token Origin: http://localhost:4200 Connection: keep-alive Cache-Control: max-age=0

The java application response is:

HTTP/1.1 200 Set-Cookie: JSESSIONID=70A5ED7E8D32DCEE55991D3945994AB0; Path=/blablab; HttpOnly Set-Cookie: XSRF-TOKEN=35ad4230-b664-400c-84c0-7d06877bf05d; Path=/ Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: http://localhost:4200 Access-Control-Allow-Methods: GET,POST,PUT,DELETE,HEAD,OPTIONS Access-Control-Allow-Headers: iv-groups, iv-user, x-xsrf-token Access-Control-Allow-Credentials: true Access-Control-Max-Age: 1800 Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Content-Length: 0 Date: Thu, 22 Nov 2018 08:31:18 GMT

For firefox this response is an CORS violation on the console it writes Credential is not supported if the CORS header Access-Control-Allow-Origin is * .

For google chrome the request is ok and the content is showed.

Answer 1

That happens if you are using withCredentials in your client side request. In that case you can modify the server side to check allowed referers and send the correct url in the Access-Control-Allow-Origin header. If you do not use credentials * is accepted.

Some more information can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials

Answer 2

For everyone coming here searching for this issue:

I had an extension installed ( CORS Unblock ) which had overwritten the headers. Turning that off or uninstalling it removed the problem.

Answer 3

This config worked for me. Pay attention in client side withCredentials: true

Client side config:

config = {
    url:'http://somedomain',
    method:'post',
    withCredentials: true,
    data:{myfield:"myvalue"}
};

axios.request(config);

Server side config:

Access-Control-Allow-Credentials   true
Access-Control-Allow-Headers  X-PINGOTHER, Content-Type
Access-Control-Allow-Methods GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS
Access-Control-Allow-Origin: http://localhost:4200 // WILD CARD WILL NOT WORK WHEN POSTING