title: 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'
body: <p>I am try to convert my electron app to full web. when I am running the app from my localhost I get this error:</p>
  
  <blockquote>
    <p>Failed to load <a href="https://agrt.herokuapp.com/login" rel="nofollow noreferrer">https://agrt.herokuapp.com/login</a>: Response to
    preflight request doesn't pass access control check: The value of the
    'Access-Control-Allow-Origin' header in the response must not be the
    wildcard '*' when the request's credentials mode is 'include'. Origin
    '<a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a>' is therefore not allowed access. The
    credentials mode of requests initiated by the XMLHttpRequest is
    controlled by the withCredentials attribute.</p>
  </blockquote>
  
  <p>on my client I sent a http request with:</p>
  
  <pre><code>this.http.post(Consts.REMOTE_URL + '/login', {
        username: username,
        password: password
      }, {withCredentials:true}).
  </code></pre>
  
  <p>on my server I use cors ant I set: </p>
  
  <pre><code>app.use(function(req,res,next){
          res.header("Access-Control-Allow-Origin","http://localhost:4200");
          res.header('Access-Control-Allow-Headers', 'X-Requested-With,content-type, Accept');
          res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');
          res.header('Access-Control-Allow-Credentials', true);
          next();
      })
  </code></pre>
  
  <p><strong>my server is on heroku.</strong></p>
  
  <p>when I am running from the electron everything going well.</p>
  
  <p>please, any help will be great!</p>
  
  <p>the server.js:</p>
  
  <pre><code>const express = require('express')
  const passport = require('passport')
  const winston = require('winston')
  const db = require('./db')
  const cors = require('cors')
  require('dotenv').config()
  
  const port = process.env.PORT || 9000
  const app = express()
  
  app.use(cors())
  require('./config/passport')(passport, db)
  require('./config/express')(app, passport, db.pool, db)
  require('./app/routes')(app, passport)
  
  app.use(function (err, req, res, next) {
    if (err.message &amp;&amp; (~err.message.indexOf('not found'))) {
      return next()
    }
    winston.error(err.stack)
    return res.status(500).json({error: 'Error on backend occurred.'})
  })
  
  const server = app.listen(port, () =&gt; {
    console.log("listening to port: "+port);
    if(app.get('env') === 'test') return
  
    winston.log('Express app started on port ' + port)
  })
  
  server.on('close', () =&gt; {
    winston.log('Closed express server')
  
    db.pool.end(() =&gt; {
      winston.log('Shut down connection pool')
    })
  })
  </code></pre>
  
  <p>the express.js:</p>
  
  <pre><code>const path = require('path')
  const express = require('express')
  const expressHandlebars = require('express-handlebars')
  const expressValidator = require('express-validator')
  const session = require('express-session')
  const pgSession = require('connect-pg-simple')(session)
  const bodyParser = require('body-parser')
  const cookieParser = require('cookie-parser')
  const methodOverride = require('method-override')
  const morgan = require('morgan')
  const winston = require('winston')
  const config = require('./')
  const resumable = require('../app/lib/resumablejs')
  const env = process.env.NODE_ENV || 'development'
  
  module.exports = (app, passport, pool, db) =&gt; {
      let log = 'dev'
      if (env !== 'development') {
      log = {
        stream: {
          write: message =&gt; winston.info(message)
        }
      }
    }
  
      if (env !== 'test') app.use(morgan(log))
  
      app.engine('handlebars', expressHandlebars())
      app.set('view engine', 'handlebars')
  
      app.use(bodyParser.json())
      app.use(bodyParser.urlencoded({ extended: true }))
      app.use(expressValidator())
  
      app.use(methodOverride(function (req) {
          if (req.body &amp;&amp; typeof req.body === 'object' &amp;&amp; '_method' in req.body) {
              var method = req.body._method
              delete req.body._method
              return method
          }
      }))
  
      app.use(cookieParser())
      app.use(session({
          store: new pgSession({
              pool
          }),
          secret: config.session_secret,
          // saveUninitialized: false,
          // resave: false,
           cookie: { maxAge: 14 * 24 * 60 * 60 * 1000 }
      }))
  
      /////////////////////////////////////////
      app.use(function(req,res,next){
          res.header("Access-Control-Allow-Origin","http://localhost:4200");
          res.header('Access-Control-Allow-Headers', 'X-Requested-With,content-type, Accept');
          res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');
          res.header('Access-Control-Allow-Credentials', true);
          next();
      })
      //////////////////////////////////////////
  
      app.use(passport.initialize())
      app.use(passport.session())
  
      app.use('/', express.static(path.join(config.root, 'public')))
      app.use('/files', resumable(undefined, undefined, db))
  }
  </code></pre>