XMLHttpRequest 'Access-Control-Allow-Origin'... the response must not be the wildcard '*' when the request's credentials mode is 'include'

Question

I use Express Js with cloud functions in the back-end and Angular in the Front-end. I tried several solutions posted on Stackoverflow but no change. Here is my back-end code

    const app = express();
    const main = express();
    main.use('/v1', app);
    main.use(bodyParser.json());
    main.use(bodyParser.urlencoded({ extended: false }));
    // ROUTES
    app.get('/posts/:postId', function(req, res, next){
            res.set('Access-Control-Allow-Origin', '*');
            res.set('Access-Control-Allow-Methods', 'GET, PUT, POST, OPTIONS');
            res.set('Access-Control-Allow-Headers', '*');
  
            if (req.method === 'OPTIONS') {
           // Send response to OPTIONS requests
           res.set('Access-Control-Allow-Methods', 'GET');
           res.set('Access-Control-Allow-Headers', 'Content-Type');
           res.set('Access-Control-Max-Age', '3600');
           return next();
           } else {
           return next();
           } }, function(req, res){
           firebaseHelper.firestore.getDocument(db, 'posts', req.params.postId).then(
            (doc) => res.status(200).send(doc),
             (err) =>  res.status(400).send('error about getting post')); });

Angular Code

 onGetPost(postId) {
          const header = new HttpHeaders( { 'application/json'  });
          const option = {headers: header};
          this.subscription = this.http.get(`https://my-url.web.app/v1/post/${postId}`, 
          option).subscribe(
            (data: any[]) => { this.post.next(data); resolve('ok'); },
            (err) => reject(err)
          );
}

thank you in advance for your help

score 1 · Answer 1 · answered Jul 21 '20 at 12:58

Are you sure you are not sending the request with

withCredentials: true

? (You might have interceptors defined to add it to the request) If so, remove it if you don't need it.

Otherwise, set your origins in the backend to mirror the frontend's origin. See this detailed answer for more information

XMLHttpRequest 'Access-Control-Allow-Origin'... the response must not be the wildcard '*' when the request's credentials mode is 'include'

1 Answers1