title: 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true'
body: <p>I'm using node, express on backend and angular4 at client side which is giving me following error:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="http://localhost:4876/login/check" rel="noreferrer">http://localhost:4876/login/check</a>. Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. Origin '<a href="http://localhost:4200" rel="noreferrer">http://localhost:4200</a>' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.</p>
  </blockquote>
  
  <p>Api for login/check is implimented as below:</p>
  
  <pre><code>router.get('/login/check', (req: any, res: any) =&gt; {
          let api = new ApiConnection(req, res);
          let accessCard: IAccessCard = api.getContent(Auth.ACCESS_CARD_KEY);
          if(!Auth.isValid(accessCard))
              return api.response.error();
  
          ChatBox.auth.isExpired(accessCard, function (err:any, isExpired: boolean) {
              if (err) return api.response.error();
              if(!isExpired) {
                  api.cookie("AccessCard", accessCard);
                  api.response.success(accessCard);
              }
              else {
                  api.response.error();
              }
          })
      });
  </code></pre>
  
  <p>Where router definition is <code>const router = require('express').Router()</code> </p>
  
  <p>Setting middleware for header and cors is as follows:</p>
  
  <pre><code>export class Application {
      private app:any = express();
      constructor() {
          this.setCors();
          this.setHeaders();
      }
  
      public getApp():any {
          return this.app;
      }
  
      private setCors(){
          let whitelist = ['http://localhost:4200','http://localhost:80'];
          let corsOptions = {
              origin: (origin:any, callback:any)=&gt;{
                  if (whitelist.indexOf(origin) !== -1) {
                      callback(null, true)
                  } else {
                      callback(new Error('Not allowed by CORS'))
                  }
              }
          }
          this.app.use(cors(corsOptions));
      }
  
  
  
      private setHeaders() {
          this.app.use(function (req:any, res:any, next: any) {
  
              // Website you wish to allow to connect
              //res.setHeader('Access-Control-Allow-Origin', Config.WEB_APP_HOST);
              res.setHeader('Access-Control-Allow-Origin', 'http://localhost:4200');
  
              // Request methods you wish to allow
              res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');
  
              // Request headers you wish to allow
              res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With, content-type');
  
              // Set to true if you need the website to include cookies in the requests sent
              // to the API (e.g. in case you use sessions)
              res.setHeader('Access-Control-Allow-Credentials', true);
  
              // Pass to next layer of middleware
              next();
          });
      }
  }
  </code></pre>
  
  <p>On client side I'm using Api as follows:</p>
  
  <pre><code>public startSession(callback: (status: boolean, result: any) =&gt; void ) {
      let self: ChatBox = this;
      /**
       * @res.result: IAccessCard
       */
      this.mApiConnection.get(Api.root+'/login/check', (res: any) =&gt; {
        if (res.status == ResponseStatus.SUCCESS) {
          self.mStorage.storeAccessCard(res.result);
          self.loadAccount(res.result);
        }
        callback(res.status, res.result);
      })
    }
  </code></pre>