A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true Origin 'http://localhost' is therefore not allowed access The credentials mode of an XMLHttpRequest is controlled by the withCredentials attribute