title: How to send session ID cookie in a cross-origin request?
body: <p>I'm using the Peloton API to generate statistics based on workout data grabbed from their API. Certain API requests require the user to be logged in, which can be done by sending your username and password to /auth/login. It returns a session ID that is needed to get those locked requests, such as workout history. The session ID is seemingly sent as a cookie (using credentials: 'include').</p>
  <p>When I set credentials to include, it says <code>&quot;Access to fetch at (url) from origin (my site) has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '\*' when the request's credentials mode is 'include'.</code> How do I fix this? My code is below.</p>
  <pre><code>async function loginAndGetData(username, password) {
      const info = { 'username_or_email': username, 'password': password };
      const response = await fetch(&quot;https://pelotoncors.herokuapp.com/https://api.onepeloton.com/auth/login&quot;,
  {
      method: 'POST',
      body: JSON.stringify(info)
  });
      const loginInfo = await response.json();
      const workoutInfo = await fetch('https://pelotoncors.herokuapp.com/https://api.onepeloton.com/api/user/' + loginInfo.user_id + '/workouts?limit=1234567890',
  {
      method: 'GET',
      credentials: 'include'
  });
  }
  </code></pre>