title: how to allow cors for specific domain on express
body: <p>I am trying to send a cookie after login via ajax from localhost to a server hosted somewhere else. TO counter the error related to cookies, I use in my axios: </p>
  
  <pre><code>var instance = axios.create({ 
     withCredentials: true
  });
  </code></pre>
  
  <p>and in expressjs I have this: </p>
  
  <pre><code>app.use(function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
  });
  </code></pre>
  
  <p>So, I am getting this error now </p>
  
  <blockquote>
    <p>Failed to load <a href="https://foo.herokuapp.com/login" rel="nofollow noreferrer">https://foo.herokuapp.com/login</a>: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin '<a href="http://localhost:8080" rel="nofollow noreferrer">http://localhost:8080</a>' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.</p>
  </blockquote>
  
  <p>How can I tell express to whitelist my domain or how do I just send back the cookie so I can stay logged in? </p>
  
  <p>To add more info, when I make a post (login) request to the expressjs, it returns a cookie, now my browser does not send the cookie by iself, so that is why I am usiing <code>withCredentials</code></p>