title: CORS preflight response doesn't match actual response
body: <p>In my node.js server I have included CORS as middleware like so: </p>
  
  <pre><code>app.use(cors({ origin: 'http://&lt;CORRECT_ORIGIN_URL&gt;:3030', credentials: true }))
  </code></pre>
  
  <p>I'm using Apollo Client in the app that sends the request, and have set credentials to 'include' when initialising ApolloClient, like so:</p>
  
  <pre><code>// Create a WebSocket link
  const wsLink = process.browser ? new WebSocketLink({
      uri: `ws://&lt;CORRECT_REQUEST_URL&gt;:8000/graphql`,
      options: {
          reconnect: true,
      },
  }) : null
  
  // Create an http link (use batch, allow cookies response from server)
  const httpLink = new BatchHttpLink({
      uri: 'http://&lt;CORRECT_REQUEST_URL&gt;/api/',
      credentials: 'include'
  })
  
  
  // Split terminating link for websocket and http requests
  const terminatingLink = process.browser ? split(
      ({ query }) =&gt; {
          const { kind, operation } = getMainDefinition(query)
          return kind === 'OperationDefinition' &amp;&amp; operation === 'subscription'
      },
      wsLink,
      httpLink,
  ) : httpLink
  
  // Create Apollo client
  const client = new ApolloClient({
      link: ApolloLink.from([authLink, errorLink, terminatingLink])
  })
  </code></pre>
  
  <p>When I attempt to sign-in, I can see that a preflight OPTIONS request is sent and gets the correct response back:</p>
  
  <p><strong>Request Headers (OPTIONS request)</strong></p>
  
  <pre><code>Access-Control-Request-Headers: content-type
  Access-Control-Request-Method: POST
  Origin: http://&lt;CORRECT_ORIGIN_URL&gt;:3030
  Referer: http://&lt;CORRECT_ORIGIN_URL&gt;/login
  </code></pre>
  
  <p><strong>Response Headers (OPTIONS request)</strong></p>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: content-type
  Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
  Access-Control-Allow-Origin: http://&lt;CORRECT_ORIGIN_URL&gt;:3030
  Connection: keep-alive
  Content-Length: 0
  Date: Wed, 20 Mar 2019 03:09:14 GMT
  Server: nginx/1.15.5 (Ubuntu)
  Vary: Origin, Access-Control-Request-Headers
  X-Powered-By: Express
  </code></pre>
  
  <p>Yet when the actual POST request is sent, I get the following response:</p>
  
  <p><strong>Response Headers (POST request)</strong></p>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Origin: *
  Connection: keep-alive
  Content-Encoding: gzip
  Content-Type: application/json
  Date: Wed, 20 Mar 2019 03:09:15 GMT
  Server: nginx/1.15.5 (Ubuntu)
  Transfer-Encoding: chunked
  Vary: Accept-Encoding, Origin
  X-Powered-By: Express
  </code></pre>
  
  <p>I have no idea why the response headers are different in the post request when the options preflight show that it should be correct.</p>
  
  <p>This incorrect POST response leads to the following error message on the client:</p>
  
  <pre><code>Access to fetch at 'http://&lt;CORRECT_REQUEST_URL/api/' from origin
  'http://&lt;CORRECT_ORIGIN_URL&gt;:3030' has been blocked by CORS policy: 
  The value of the 'Access-Control-Allow-Origin' header in the response 
  must not be the wildcard '*' when the request's credentials mode is
  'include'.
  </code></pre>
  
  <p>I've tried googling and searching stackoverflow for a solution but can't find anything. Any ideas?</p>