DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Web Security Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
Web Security
Why can't a server respond with Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true?
A
This combination is actually allowed and commonly used
B
Browsers reject this combination outright — it would let an accidentally-permissive wildcard API expose cookie-authenticated, user-specific data to literally every origin
C
It's a performance optimization the spec removed
D
Wildcards are simply deprecated syntax with no other meaning
Check Answer