CS Fundamentals Trainer · JavaScript · Security
If a server responds with Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true, a cross-origin page can read the…
If a server responds with `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Credentials: true`, a cross-origin page can read the response to `fetch(url, { credentials: 'include' })`.
Difficulty: medium