Credentials and the site boundary
Cookies and CORS answer different questions. Cookie rules decide whether a credential travels with a request; CORS decides whether the browser lets this page read the response. These five cases separate those two decisions, then separate origin, site, and cookie scope.
1 · The cookie can arrive while the read still fails
Use the setup ribbon above, then run this credentialed request. The
server's record shows Cookie present: yes, but the
response omits Access-Control-Allow-Credentials: true.
Press Run this demo to fire a real cross-origin request and see this failure happen live — it never runs automatically.
2 · Credentials make * literal
A wildcard origin grant cannot authorise a credentialed read. Run the fixed case here; for the console variants and minimal server fix, see Error-gallery exhibit 5.
Press Run this demo to fire a real cross-origin request and see this failure happen live — it never runs automatically.
3 · Same-site can still be cross-origin
Set one host-only copy on each API host, then compare the credentialed
checks. This isolates the SameSite=Lax and
SameSite=Strict decision from cookie-domain scope.