Seconded. And if you have Access-Control-Allow-Credentials then Access-Control-Allow-Origin must reflect the origin, * is not enough.<p>It&#x27;s safe to put Access-Control-Allow-Origin:* on any publicly-accessible server, since another server could simply proxy that stuff anyway.