title: CORS: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true
body: <p>I have a setup involving</p>
  
  <p>Frontend server (Node.js, domain: localhost:3000) &lt;---> Backend (Django, Ajax, domain: localhost:8000)</p>
  
  <p>Browser &lt;-- webapp &lt;-- Node.js (Serve the app)</p>
  
  <p>Browser (webapp) --> Ajax --> Django(Serve ajax POST requests)</p>
  
  <p>Now, my problem here is with CORS setup which the webapp uses to make Ajax calls to the backend server. In chrome, I keep getting</p>
  
  <blockquote>
    <p>Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.</p>
  </blockquote>
  
  <p>doesn't work on firefox either.</p>
  
  <p>My Node.js setup is:</p>
  
  <pre><code>var allowCrossDomain = function(req, res, next) {
      res.header('Access-Control-Allow-Origin', 'http://localhost:8000/');
      res.header('Access-Control-Allow-Credentials', true);
      res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
      res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
      next();
  };
  </code></pre>
  
  <p>And in Django I'm using <a href="https://gist.github.com/strogonoff/1369619" rel="noreferrer">this middleware</a> <a href="https://github.com/ottoyiu/django-cors-headers" rel="noreferrer">along with this</a></p>
  
  <p>The webapp makes requests as such:</p>
  
  <pre><code>$.ajax({
      type: "POST",
      url: 'http://localhost:8000/blah',
      data: {},
      xhrFields: {
          withCredentials: true
      },
      crossDomain: true,
      dataType: 'json',
      success: successHandler
  });
  </code></pre>
  
  <p>So, the request headers that the webapp sends looks like:</p>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: "Origin, X-Requested-With, Content-Type, Accept"
  Access-Control-Allow-Methods: 'GET,PUT,POST,DELETE'
  Content-Type: application/json 
  Accept: */*
  Accept-Encoding: gzip,deflate,sdch
  Accept-Language: en-US,en;q=0.8
  Cookie: csrftoken=***; sessionid="***"
  </code></pre>
  
  <p>And here's the response header:</p>
  
  <pre><code>Access-Control-Allow-Headers: Content-Type,*
  Access-Control-Allow-Credentials: true
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETE
  Content-Type: application/json
  </code></pre>
  
  <p>Where am I going wrong?!</p>
  
  <p>Edit 1: I've been using <code>chrome --disable-web-security</code>, but now want things to actually work.</p>
  
  <p>Edit 2: Answer:</p>
  
  <p>So, solution for me <code>django-cors-headers</code> config:</p>
  
  <pre><code>CORS_ORIGIN_ALLOW_ALL = False
  CORS_ALLOW_CREDENTIALS = True
  CORS_ORIGIN_WHITELIST = (
      'http://localhost:3000' # Here was the problem indeed and it has to be http://localhost:3000, not http://localhost:3000/
  )
  </code></pre>