A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. about serverless-cors-plugin

[chadkouse]

What do you think about an option to allow you to pass back the host that is making the request in the Access-Control-Allow-Origin header -- in other words, instead of * it just looks at who's calling and returns that host name -- this would allow authenticated requests to come from anywhere.

[joostfarla]

Thank again for reporting! You are getting this error in the browser console, right?

I suspect you have set the withCredentials option to true in whatever JS library that is performing the XHR request? If yes, did you mean to make authorized requests?

If you really want to make authorized requests:

• The Access-Control-Allow-Credentials header has to be set to true. However, the plugin does not support this header at this time. I'll probably release support for this today or tomorrow.
• You have to set a specific host in the Access-Control-Allow-Origin header. CORS doen not allow a wildcard (*) origin for authorized requests.

[alexmuro]

That was it, thank you!
Also thank you for this plugin its a huge time saver.
I am using https://github.com/Netflix/falcor-http-datasource to make requests and it has some odd defaults.

[joostfarla]

@chadkouse Thanks for reaching out! That is indeed something I've been thinking about and it definitely could be an interesting addition for authorized requests! I'll create an issue for this.