FrontendHaltBrowser internals·Intermediate·Conceptual·1 min read
What does Access-Control-Allow-Credentials require?
Short interview answer
When a request includes credentials such as cookies, the server must return an exact matching Access-Control-Allow-Origin rather than a wildcard, plus Access-Control-Allow-Credentials: true, or the browser withholds the response from script.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.