title: Why do the CORS settings for my Express.js backend not work?
body: <p>I am trying to set CORS for my Express.js backend. Since I have a local and a remote version of the front end I want to allow a couple of URLS access to the backend. I have tried to use "*" and <code>var cors = require('cors') app.use(cors())</code> but I get </p>
  
  <blockquote>
    <p>Cannot use wildcard in Access-Control-Allow-Origin when credentials
    flag is true.</p>
  </blockquote>
  
  <p>I have tried using the dynamic settings for cors(), but there were no examples how to use it with Express's routes. I am now trying to create my own white list check with the code below but now I am getting</p>
  
  <blockquote>
    <p>No 'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://localhost:5000" rel="nofollow">http://localhost:5000</a>' is therefore not allowed
    access. The response had HTTP status code 500.</p>
  </blockquote>
  
  <p>What am I doing wrong?</p>
  
  <p><strong>UPDATE:</strong> It looks like the if statement is blocking the headers from being added so I tried to remove it to see what is happening with <code>res.header('Access-Control-Allow-Origin', req.get("origin"));</code> It is now giving me </p>
  
  <blockquote>
    <p>Credentials flag is 'true', but the 'Access-Control-Allow-Credentials'
    header is ''. It must be 'true' to allow credentials.</p>
  </blockquote>
  
  <pre><code>var whiteList = {
      "http://localhost:5000": true,
      "https://example-url.herokuapp.com": true
  };
  var allowCrossDomain = function(req, res, next) {    
          if(whiteList[req.get('Origin')]){            
              res.header('Access-Control-Allow-Credentials', true);
              res.header('Access-Control-Allow-Origin', req.get('Origin'));
              res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
              res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, Content-Length, X-Requested-With, Origin, Accept');        
              next();
          } 
  };
  app.use(allowCrossDomain);
  </code></pre>