title: How to fix CORS error: request doesn't pass access control check?
body: <p>I have express.js server:</p>
  
  <pre><code>import express from 'express';
  import cors from 'cors';
  import bodyParser from 'body-parser';
  import mongoose from 'mongoose';
  import helmet from 'helmet';
  import config from './config/config.js';
  import authRoutes from './routes/auth.js';
  import userRoutes from './routes/user.js';
  
  mongoose.connect(config.mongoUri, { useNewUrlParser: true });
  mongoose.connection.on('error', () =&gt; {
    throw new Error(`unable to connect to database: ${config.mongoUri}`);
  });
  const port = 9000;
  const app = express();
  
  app.use(helmet());
  app.use(bodyParser.json());
  app.use(bodyParser.urlencoded({ extended: true }));
  app.use(cors());
  app.use((req, res, next) =&gt; {
    res.header('Access-Control-Allow-Origin', '*');
    res.header('Access-Control-Allow-Methods', 'POST,GET,LINK');
  });
  app.use('/', authRoutes);
  app.use('/', userRoutes);
  app.listen(port, () =&gt; console.log(`Example app listening on port ${port}!`));
  
  </code></pre>
  
  <p>Cors package install corectly in package.json.
  Here is my routes </p>
  
  <pre><code>import express from 'express';
  
  import authCtrl from '../controllers/auth.controller.js';
  
  const router = express.Router();
  
  router.route('/auth/signin').post(authCtrl.signin);
  router.route('/auth/signout').get(authCtrl.signout);
  
  export default router;
  </code></pre>
  
  <p>When i trying to make request from Postman - all is working,
  but when try to do in from another server : </p>
  
  <pre><code>const signin = user =&gt; {
    console.log('user', user);
    return fetch('http://localhost:9000/auth/signin/', {
      method: 'POST',
      headers: {
        'Access-Control-Allow-Origin': '*',
        Accept: 'application/json',
      },
      credentials: 'include',
      body: JSON.stringify(user),
    })
      .then(response =&gt; {
        return response.json();
      })
      .catch(err =&gt; console.log(err));
  };
  </code></pre>
  
  <p>It's error occur in the console </p>
  
  <blockquote>
    <p>Access to fetch at '<a href="http://localhost:9000/auth/signin/" rel="nofollow noreferrer">http://localhost:9000/auth/signin/</a>' from origin
    '<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.</p>
  </blockquote>
  
  <p>In network i can see OPTIONAL request : 
  Access-Control-Allow-Headers: access-control-allow-origin
  Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
  Access-Control-Allow-Origin: *</p>
  
  <p>So how can I fix this problem?</p>