title: Angular: A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true
body: <p>I know there are a lot of questions concerning CORS already but they don't seem to answer my question.</p>
  
  <p>So I have a client app written in Angular which will be used to create a mobile app (with Apache Cordova). The html files and JavaScript files will be loaded from the mobile device.
  When I simulate that and I send requests to the REST API server I first got 
  "No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<code>http://localhost:82</code>' is therefore not allowed access".
  So I added header("Access-Control-Allow-Origin: *"); in my php REST API Server. I cannot specify a specific domain as the requests will come from the mobile devices.</p>
  
  <p>Now I got to "A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true."</p>
  
  <p>I finally found a solution but I'm not sure it is safe to keep it like this.</p>
  
  <p>In my php REST API Server I added this:</p>
  
  <pre class="lang-php prettyprint-override"><code>if (isset($_SERVER['HTTP_ORIGIN'])) {
    header("Access-Control-Allow-Credentials: true");
    header("Access-Control-Allow-Origin: " . $_SERVER['HTTP_ORIGIN']);
    header("Access-Control-Allow-Headers: *, X-Requested-With, Content-Type");
    header("Access-Control-Allow-Methods: GET, POST, DELETE, PUT");
  }
  </code></pre>
  
  <p>Please advise on this way of working. If it is not secure or no good at all, can you please tell me how to solve this issue?</p>
  
  <p>Thanks a lot!</p>