DevToolsmith

Access-Control-Allow-Credentials Header

The Access-Control-Allow-Credentials response header allows a cross-origin request made with cookies or HTTP authentication to read the response.

Type
Response header
Category
CORS
Defined in
Fetch Standard

Syntax

Access-Control-Allow-Credentials: true

How Access-Control-Allow-Credentials works

Only needed when the client sends credentials: fetch(url, { credentials: 'include' }) or xhr.withCredentials = true. The only valid value is true. With it, Access-Control-Allow-Origin must name the exact origin; * is rejected, and so are * in Allow-Headers and Allow-Methods.

Examples

Cookie-authenticated API
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true

Common mistakes

  • Cross-site cookies are also subject to SameSite: the cookie needs SameSite=None; Secure to be sent at all.

Check it

curl -sI https://example.com | grep -i '^access-control-allow-credentials:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

  • Access-Control-Allow-Origin: tells the browser which origin may read a cross-origin response.
  • Set-Cookie: stores a cookie in the browser, with attributes that control its lifetime, scope and security.
  • Origin: tells the server which origin (scheme, host and port) a request comes from.

More cors headers

Access-Control-Allow-Methods , Access-Control-Allow-Headers , Access-Control-Expose-Headers , Access-Control-Max-Age .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Access-Control-Allow-Credentials header do?

The Access-Control-Allow-Credentials response header allows a cross-origin request made with cookies or HTTP authentication to read the response. Only needed when the client sends credentials: fetch(url, { credentials: 'include' }) or xhr.withCredentials = true. The only valid value is true. With it, Access-Control-Allow-Origin must name the exact origin; * is rejected, and so are * in Allow-Headers and Allow-Methods.

How do I see the Access-Control-Allow-Credentials header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.