# CORS with included credentials

**URL:** <https://forum.serverless.com/t/cors-with-included-credentials/3623>\
**Category:** Serverless Framework\
**Tags:** aws, lambda\
**Created:** [January 28, 2018, 12:10pm UTC](https://forum.serverless.com/t/cors-with-included-credentials/3623 "2018-01-28T12:10:15Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![OrKoN](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/orkon/32/1569_2.png) [@OrKoN](https://forum.serverless.com/u/OrKoN)\
**Post date:** [January 28, 2018, 12:10pm UTC](https://forum.serverless.com/t/cors-with-included-credentials/3623/1 "2018-01-28T12:10:15Z")

</div>

Hey,

I have tried using CORS with allowCredentials=true. The problem is that if I use the credentials=include option on the client side, I get an error message: “Failed to load [https://service.domain.com/url/url2:](https://service.domain.com/url/url2:) Response to preflight request doesn’t pass access control check: The value of the ‘Access-Control-Allow-Origin’ header in the response must not be the wildcard ‘\*’ when the request’s credentials mode is ‘include’. Origin ‘[https://domain.com](https://domain.com)’ is therefore not allowed access.”

It seems like serverless hard-codes the wildcard ‘\*’ for the preflight requests in the AWS Gateway Method. But for secure cross-origin requests, the header cannot be a wildcard. My config for the function:

```
 cors:
        origin: '*'
        headers:
          - Content-Type
          - X-Amz-Date
          - Authorization
          - X-Api-Key
          - X-Amz-Security-Token
          - X-Amz-User-Agent
        allowCredentials: true

```

Is it bug or can I configure the desired behavior somehow?

---

<div class="post-metadata">

**Author:** ![Borduhh](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/borduhh/32/3074_2.png) [@Borduhh](https://forum.serverless.com/u/Borduhh)\
**Post date:** [February 22, 2019, 7:55pm UTC](https://forum.serverless.com/t/cors-with-included-credentials/3623/2 "2019-02-22T19:55:57Z")

</div>

Any luck with this? I am running into the same exact problem trying to save a JWT in a HTTPOnly Cookie.

---

<div class="post-metadata">

**Author:** ![OrKoN](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/orkon/32/1569_2.png) [@OrKoN](https://forum.serverless.com/u/OrKoN)\
**Post date:** [February 22, 2019, 8:15pm UTC](https://forum.serverless.com/t/cors-with-included-credentials/3623/3 "2019-02-22T20:15:00Z")

</div>

Not really. I decided not to use cookies for my use case. I think you may work around it by specifying origin to be your domain if you have a single domain (instead of `origin: '*'`). In general, I’d suggest not to use serverless’ api gateway integration if you need fine-grained control over CORS. It’s better to use a lambda to respond to the options request and respond with dynamic origins.

---

<div class="post-metadata">

**Author:** ![stephencrowe](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@stephencrowe](https://forum.serverless.com/u/stephencrowe)\
**Post date:** [March 14, 2019, 5:15pm UTC](https://forum.serverless.com/t/cors-with-included-credentials/3623/4 "2019-03-14T17:15:34Z")

</div>

I have this same problem and have not found a solution yet either.

---

<div class="post-metadata">

**Author:** ![ronkot](https://avatars.discourse-cdn.com/v4/letter/r/5daacb/32.png) [@ronkot](https://forum.serverless.com/u/ronkot)\
**Post date:** [February 3, 2020, 6:06am UTC](https://forum.serverless.com/t/cors-with-included-credentials/3623/5 "2020-02-03T06:06:59Z")

</div>

I also encountered the same problem. If you know exactly the origins that can access your api, then you can configure the allowed origins using serverless’ cors feature: [https://serverless.com/framework/docs/providers/aws/events/apigateway#enabling-cors](https://serverless.com/framework/docs/providers/aws/events/apigateway#enabling-cors)

But if you’d need to allow credentials for **any** origin, serverless cannot do that for you (AFAIK). In that case you need to handle the OPTIONS request by yourself and set the `Access-Control-Allow-Origin` to same value as request `Origin` header. Remember to set all other cors headers as well.

---

<div class="post-metadata">

**Author:** ![danielo515](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@danielo515](https://forum.serverless.com/u/danielo515)\
**Post date:** [June 1, 2020, 10:28am UTC](https://forum.serverless.com/t/cors-with-included-credentials/3623/6 "2020-06-01T10:28:56Z")

</div>

So sad this is not properly supported.

This is what I’m doing:

```
  authEcho:
    handler: src/users/me.handler
    events:
      - http:
          path: me
          method: get
          cors:
            origin: https://my.domain.es
            allowCredentials: true

```

The neat thing is that you don’t need to add all the extra headers or other complex stuff. The problem is that, as other has stated, you can not specify dynamic origins, and you can not use `*` if the allowCredentials is set to true.