Explicitly set your origin when using Allow Credentials == true. Check this other post: CORS: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true