fix: do not send Access-Control-Allow-Credentials

Cookies to not reliably work.

BREAKING CHANGE: this removes the Access-Control-Allow-Credentials

Author: coderbyheart

src/corsHeaders.spec.ts

@@ -11,7 +11,6 @@ void describe('corsHeaders()', () => {
 				},
 			}),
 			{
-				'Access-Control-Allow-Credentials': true,
 				'Access-Control-Allow-Headers':
 					'accept, authorization, content-type, if-match, origin',
 				'Access-Control-Expose-Headers':

src/corsHeaders.ts

@@ -24,15 +24,13 @@ export const corsHeaders = (
 	allowedMethods = ['PUT', 'DELETE', 'POST', 'GET', 'PATCH'],
 	cacheForSeconds = 600,
 ): {
-	'Access-Control-Allow-Credentials': true
 	'Access-Control-Allow-Headers': string
 	'Access-Control-Expose-Headers': string
 	'Access-Control-Allow-Methods': string
 	'Access-Control-Allow-Origin': string
 	'Access-Control-Max-Age': number
 	Vary: 'Origin'
 } => ({
-	'Access-Control-Allow-Credentials': true,
 	'Access-Control-Allow-Origin': origin({ headers }),
 	'Access-Control-Allow-Methods': allowedMethods.join(', '),
 	'Access-Control-Allow-Headers': Array.from(