title: What exactly does the Access-Control-Allow-Credentials header do?
body: <p>I'm trying to understand how to use CORS and am confused about what the <code>Access-Control-Allow-Credentials</code> header does.</p>
  
  <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS">The documentation</a> says</p>
  
  <blockquote>
    <p>Indicates whether or not the response to the request can be exposed
    when the credentials flag is true.</p>
  </blockquote>
  
  <p>But I don't understand what the response being "exposed" means.</p>
  
  <p>Can anyone explain what this header being set to true (in conjunction with the credentials flag being set to true) actually does?</p>