Seconded. And if you have Access-Control-Allow-Credentials then Access-Control-Allow-Origin must reflect the origin, * is not enough. It's safe to put Access-C

Seconded. And if you have Access-Control-Allow-Credentials then Access-Control-Allow-Origin must reflect the origin, * is not enough. It's safe to put Access-Control-Allow-Origin:* on any publicly-accessible server, since another server could simply proxy that stuff anyway.