title: Firefox: CORS Missing Allow Header
body: <p>My firefox is issuing an OPTIONS preflight request to my private backend to make a subsequent GET request with credentials.</p>
  <p>The preflight request includes the headers</p>
  <pre><code>Origin http://localhost:9670
  Access-Control-Request-Headers authorization
  Access-Control-Request-Method GET
  </code></pre>
  <p>My server responds with</p>
  <pre><code>Access-Control-Allow-Credentials true
  Access-Control-Allow-Origin http://localhost:9670
  Vary: Origin
  </code></pre>
  <p>According to the docs I found that should be fine.</p>
  <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin" rel="nofollow noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin</a></p>
  <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials" rel="nofollow noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials</a></p>
  <p>Anyway, my firefox still states</p>
  <blockquote>
  <p>CORS Missing Allow Header</p>
  </blockquote>
  <p>in the Transferred section of the Network tab in the Developer Console.</p>
  <p>What is my server response missing?</p>