title: CORS is blocking requests withCredentials
body: <p>I'm new to Node and Angular. I have a problem with Cors when sending request <code>withCredentials: true</code> option. When I send such request I got: </p>
  
  <blockquote>
    <p>The value of the 'Access-Control-Allow-Origin' header in the response
    must not be the wildcard '*' when the request's credentials mode is
    'include'.`.</p>
  </blockquote>
  
  <p>When sending request without this option I got no error. Angular is working on <a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a> and Nodejs is on <a href="http://localhost:1234" rel="nofollow noreferrer">http://localhost:1234</a>. It seems that cors module doesn't work properly.</p>
  
  <p>In the NodeJs server I use <code>cors</code> module:</p>
  
  <pre><code>const cors = require('cors');
  
  const corsOptions = {
    origin: 'http://localhost:4200',
    optionsSuccessStatus: 200,
    credentials: true
  };
  
  app.use(cors(corsOptions));
  </code></pre>
  
  <p>req.headers at server:</p>
  
  <pre><code>{ host: 'localhost:1234',
    connection: 'keep-alive',
    'content-length': '44',
    accept: 'application/json, text/plain, */*',
    origin: 'http://localhost:4200',
    'user-agent':
     'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36',
    'content-type': 'application/json',
    'sec-fetch-site': 'same-site',
    'sec-fetch-mode': 'cors',
    referer: 'http://localhost:4200/login',
    'accept-encoding': 'gzip, deflate, br',
    'accept-language': 'pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7' }
  </code></pre>
  
  <p><strong>EDIT</strong> : It seems that such simple thing like running browser in private mode resolved this issue...</p>