medium10 pts · first answer countsauthenticationcorscookies

Credentialed requests with Allow-Origin *

A frontend on app.example.com calls api.example.com with credentials: 'include'. The API returns Access-Control-Allow-Origin: *. What happens?

A.It works, because * allows every originB.It works, but the cookies are sent unencryptedC.The browser blocks it; an exact origin is neededD.The API server rejects it with a 401 status

Discussion 0

Join free to post in the discussion.

Credentialed requests with Allow-Origin *

Discussion 0

Related questions