title: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'
body: <p>My application is working fine in IE browser, <strong>But it's not working in Chrome browser due to <code>CORS</code> issue.</strong> </p>
  
  <p>The issue is </p>
  
  <blockquote>
    <p>Failed to load <a href="http://localhost:52487/api/Authentication/" rel="noreferrer">http://localhost:52487/api/Authentication/</a>: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin '<a href="http://localhost:4200" rel="noreferrer">http://localhost:4200</a>' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.</p>
  </blockquote>
  
  <p>I am using angular 2 in front-end  and using Asp.net core 1.0 in back-end. I have tried </p>
  
  <p>This is my startup code </p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddCors(options =&gt;
      {
          options.AddPolicy("AllowAll", p =&gt;
          {
              p.AllowAnyOrigin()
              .AllowAnyHeader()
              .AllowAnyMethod();
          });
      });
  
      // Add framework services.
      services.AddMvc();
      // Add functionality to inject IOptions&lt;T&gt;
      services.AddOptions();
      // Add our Config object so it can be injected
      services.Configure&lt;Data&gt;(Configuration.GetSection("Data"));
  
      services.Configure&lt;COCSettings&gt;(Configuration.GetSection("COCSettings"));
  
      services.Configure&lt;EmailSettings&gt;(Configuration.GetSection("EmailSettings"));
  
      AppSettings.ConnectionString = Configuration["Data:DefaultConnectionString"];
  
      // *If* you need access to generic IConfiguration this is **required**
      services.AddSingleton&lt;IConfiguration&gt;(Configuration);
  
      // Injecting repopsitories with interface
      AddServices(services);
  
      // Add Json options
      services.AddMvc().AddJsonOptions(options =&gt; options.SerializerSettings.ContractResolver = new DefaultContractResolver());
  }
  
  // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
  public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
  {
      loggerFactory.AddConsole(Configuration.GetSection("Logging"));
      loggerFactory.AddDebug();
      app.UseMiddleware(typeof(ErrorHandling));
      app.UseMiddleware(typeof(GetNoCache));
      app.UseCors("AllowAll");
      app.UseMvc();
  }
  </code></pre>
  
  <p>this is how I am calling the API from UI(angular) side</p>
  
  <pre><code>constructor(private http: Http) {
      this.headers = new Headers();
      this.headers.append('Accept', 'application/json');
  }
  
  GetMaintainCOC(FYONId) {
      return this.http.get(this.apiUrl + 'GetCertificationofConformity?FYONId=' + FYONId, { withCredentials: true })
      .map(responce =&gt; &lt;any&gt;responce.json())
      .catch(error =&gt; {
          return Observable.throw(error);
      });
  }
  </code></pre>