HTTP headers
Access-Control-Allow-Credentials HTTP Header Meaning
Access-Control-Allow-Credentials allows credentials on a CORS response.
Meaning
The server is saying browser credentials such as cookies may be included and exposed to the request flow.
Where it appears
Servers send it when cross-origin requests need cookies, client certificates, or HTTP auth.
What to check
Check that Access-Control-Allow-Origin is not wildcard when credentials are allowed.
Example
Access-Control-Allow-Credentials: true