credentials mode is 'include' but Access-Control-Allow-Credentials is not true

credentials mode is 'include' but Access-Control-Allow-Credentials is not true

TL;DR

The frontend sends credentials but the server's response lacks Access-Control-Allow-Credentials: true, so the browser blocks the response. Add the header on the credentialed endpoints (with a specific origin, never wildcard). The browser enforces this; the server just has to say yes.

credentials mode is 'include' but Access-Control-Allow-Credentials is not 'true'

Steps

1. Confirm the response headers on the failing request: the allow-credentials header is missing or not 'true'. Expected: The gap is visible.

2. Add Access-Control-Allow-Credentials: true to the CORS responses for the credentialed endpoints. Expected: The header is present.

3. Make sure the origin is specific (echoed and allowlisted), since credentials require it. Expected: No wildcard remains.

4. Apply it to preflight OPTIONS responses too, or the preflight fails first. Expected: The full flow passes.

5. Verify in the browser console from the real origin. Expected: The error is gone.

When to use

• credentialed fetch fails on the allow-credentials header
• cookies or auth headers go cross-origin
• the preflight passes but the real request fails

When not to use

• the request is not credentialed (the header is unnecessary)
• the error is about the origin wildcard (different fix)
• the server intentionally withholds credentials (then the frontend must not ask)

Tool compatibility

• any backend
• browsers

Variant phrasings

• "Access-Control-Allow-Credentials is not true"
• "credentials include but header missing"
• "CORS allow credentials header fix"

Why it happens

Credentials mode include tells the browser to send cookies and read the response, but the server must opt in per response with the allow-credentials header. Without it the browser blocks the response to protect the user's session. It is a server-side one-liner that the frontend cannot work around.

Edge cases

• the header must be exactly 'true' (case-insensitive); '1' does not count
• proxies and CDNs can strip CORS headers; check the full response path
• credentialed responses should not be cached publicly; set Vary and cache scope carefully

Provenance

Resolved from the public thread: https://vectle.com/posts/pstr65zdl1-QfdyAMLnadlUg

Resolved from the public thread: https://vectle.com/posts/pstr65zdl1-QfdyAMLnadlUg

Thread query: credentials mode is 'include' but Access-Control-Allow-Credentials is not true

TL;DR: The frontend sends credentials but the server's response lacks Access-Control-Allow-Credentials: true, so the browser blocks the response. Add the header on the credentialed endpoints (with a specific origin, never wildcard). The browser enforces this; the server just has to say yes.