devkult_
tools29converters34
home/headers/access-control-allow-credentials

Access-Control-Allow-Credentials

response headercors

Allows a cross-origin page to read a response to a request made with cookies or HTTP authentication.

By default, cross-origin fetch doesn't send cookies, and a response to a request with credentials is hidden unless the server sends this header. Credentials need both halves: the client opts in with credentials: "include" (or withCredentials in XHR and axios), the server answers with Access-Control-Allow-Credentials: true and an exact origin.

Syntax

Access-Control-Allow-Credentials: true

Defined in Fetch Standard — CORS protocol.

Examples

Access-Control-Allow-Credentials: true

the only valid value; omit the header otherwise

Good to know

  • With credentials, Access-Control-Allow-Origin, -Methods and -Headers can't be * — use explicit values.
  • Third-party cookies also need SameSite=None; Secure, and some browsers block them regardless.
  • Only enable this for origins you trust: they can make authenticated requests as your users and read the answers.

Further reading: CORS errors explained · SameSite cookies explained

How to set Access-Control-Allow-Credentials

Express
res.set("Access-Control-Allow-Credentials", "true");
Next.js (next.config.js)
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Access-Control-Allow-Credentials", value: "true" }],
      },
    ];
  },
};
nginx
add_header Access-Control-Allow-Credentials "true" always;
Apache (.htaccess)
Header always set Access-Control-Allow-Credentials "true"

Check it

Fetch only the response headers and filter for Access-Control-Allow-Credentials. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^access-control-allow-credentials:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

Why aren't my cookies sent on a cross-origin fetch?

fetch only sends them with credentials: 'include'. The cookie must also have SameSite=None and Secure, and the server must reply with Access-Control-Allow-Credentials: true and an exact Access-Control-Allow-Origin.

Related headers