IIRC, there’s a weird interaction where Chrome will reject your CORS request if you try to include credentials and the Access-Control-Allow-Origin is set to ‘*’.

To perform a credentialed CORS request, the header has to name an origin. So the workaround tends to be to accept an origin parameter somehow (URL parameter, request header), then, server side, use this value to populate the Access-Control-Allow-Origin header in your server response.

That way, the preflight succeeds enough to get to the actual request.