title: Value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'
body: <p>I trying to connect socket.io between Angular and Nodejs Server</p>
  
  <p>In Angular I have declared a new socket and connect it
      import * as io from 'socket.io-client';
      ...
      @component
      ...
      const socket = io.connect('<a href="http://localhost:3000" rel="noreferrer">http://localhost:3000</a>');</p>
  
  <p>In back end : server.js</p>
  
  <pre><code>const express = require('express');
  const app = express();
  var http = require('http').Server(app);
  var io = require('socket.io')(http);
  io.set('origins', 'http://localhost:4200');
  
  var routes = require('./routes/routes')(io);
  
  app.use(bodyParser.urlencoded({ extended: true }));
  app.use(bodyParser.json());
  app.use(function (req, res, next) {
      res.header("Access-Control-Allow-Origin", "*");
      res.header("Access-Control-Allow-Methods", "GET, POST, PUT ,DELETE");
      res.header(
          "Access-Control-Allow-Headers",
          "Origin, X-Requested-With, Content-Type, Accept"
      );
      next();
  });
  io.on('connection', function (socket) {
      socket.emit('news', { hello: 'world' });
      console.log("connectd");
  });
  app.use('/', routes);
  var server = app.listen(3000, function (io) {
  })
  </code></pre>
  
  <p>The app is compiling and getting data from server. but only socket.io is not working
  I get this error:</p>
  
  <blockquote>
    <p>localhost/:1 Failed to load <a href="http://localhost:3000/socket.io/?EIO=3&amp;transport=polling&amp;t=MEpHAtN" rel="noreferrer">http://localhost:3000/socket.io/?EIO=3&amp;transport=polling&amp;t=MEpHAtN</a>: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin '<a href="http://localhost:4200" rel="noreferrer">http://localhost:4200</a>' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.</p>
  </blockquote>
  
  <p>Why is error persist even after configuring CORS in server side ?</p>