title: CORS 'Allow-Credentials' Nodejs/Express
body: <p>My project is running on Node with an Express backend.</p>
  
  <p>I'm trying to query my Arango database clientside with Arangojs. ArangoDB is running on Docker on Digital Ocean. I have no issues querying my database serverside, however I get the following error on page load:</p>
  
  <blockquote>
    <p>Failed to load
    <a href="http://0.0.0.0:8529/_db/database/_api/cursor" rel="noreferrer">http://0.0.0.0:8529/_db/database/_api/cursor</a>: Response to
    preflight request doesn't pass access control check: The value of the
    'Access-Control-Allow-Credentials' header in the response is 'false'
    which must be 'true' when the request's credentials mode is 'include'.
    Origin '<a href="http://localhost:3000" rel="noreferrer">http://localhost:3000</a>' is therefore not allowed access. The
    credentials mode of requests initiated by the XMLHttpRequest is
    controlled by the withCredentials attribute.</p>
  </blockquote>
  
  <p>My code on the clientside js looks like this:</p>
  
  <pre><code>var db = new arangojs.Database({url:'http://0.0.0.0:8529'})
  db.useDatabase(dbase)
  db.useBasicAuth("database", 'password')
  db.query('FOR doc IN docs RETURN doc') // etc. etc.
  </code></pre>
  
  <p><strong>EDIT:</strong> 1 year later in hindsight this question is pretty silly - The correct answer for this is don't expose your database credentials through clientside JS... Communicate with your backend, and have that communicate with your datastore.</p>