'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the...

I am try to convert my electron app to full web. when I am running the app from my localhost I get this error:

Failed to load https://agrt.herokuapp.com/login: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'http://localhost:4200' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
​

on my client I sent a http request with:

this.http.post(Consts.REMOTE_URL + '/login', {
username: username,
password: password
}, {withCredentials:true}).


on my server I use cors ant I set:

app.use(function(req,res,next){
res.header("Access-Control-Allow-Origin","http://localhost:4200");
res.header('Access-Control-Allow-Headers', 'X-Requested-With,content-type, Accept');
res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');
res.header('Access-Control-Allow-Credentials', true);
next();
})


my server is on heroku.

when I am running from the electron everything going well.

please, any help will be great!

the server.js:

const express = require('express')
const passport = require('passport')
const winston = require('winston')
const db = require('./db')
const cors = require('cors')
require('dotenv').config()

const port = process.env.PORT || 9000
const app = express()

app.use(cors())
require('./config/passport')(passport, db)
require('./config/express')(app, passport, db.pool, db)
require('./app/routes')(app, passport)

app.use(function (err, req, res, next) {
if (err.message && (~err.message.indexOf('not found'))) {
return next()
}
winston.error(err.stack)
return res.status(500).json({error: 'Error on backend occurred.'})
})

const server = app.listen(port, () => {
console.log("listening to port: "+port);
if(app.get('env') === 'test') return

winston.log('Express app started on port ' + port)
})

server.on('close', () => {
winston.log('Closed express server')

db.pool.end(() => {
winston.log('Shut down connection pool')
})
})


the express.js:

const path = require('path')
const express = require('express')
const expressHandlebars = require('express-handlebars')
const expressValidator = require('express-validator')
const session = require('express-session')
const pgSession = require('connect-pg-simple')(session)
const bodyParser = require('body-parser')
const cookieParser = require('cookie-parser')
const methodOverride = require('method-override')
const morgan = require('morgan')
const winston = require('winston')
const config = require('./')
const resumable = require('../app/lib/resumablejs')
const env = process.env.NODE_ENV || 'development'

module.exports = (app, passport, pool, db) => {
let log = 'dev'
if (env !== 'development') {
log = {
stream: {
write: message => winston.info(message)
}
}
}

if (env !== 'test') app.use(morgan(log))

app.engine('handlebars', expressHandlebars())
app.set('view engine', 'handlebars')

app.use(bodyParser.json())
app.use(bodyParser.urlencoded({ extended: true }))
app.use(expressValidator())

app.use(methodOverride(function (req) {
if (req.body && typeof req.body === 'object' && '_method' in req.body) {
var method = req.body._method
delete req.body._method
return method
}
}))

app.use(cookieParser())
app.use(session({
store: new pgSession({
pool
}),
secret: config.session_secret,
// saveUninitialized: false,
// resave: false,
cookie: { maxAge: 14 * 24 * 60 * 60 * 1000 }
}))

/////////////////////////////////////////
app.use(function(req,res,next){
res.header("Access-Control-Allow-Origin","http://localhost:4200");
res.header('Access-Control-Allow-Headers', 'X-Requested-With,content-type, Accept');
res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');
res.header('Access-Control-Allow-Credentials', true);
next();
})
//////////////////////////////////////////

app.use(passport.initialize())
app.use(passport.session())

app.use('/', express.static(path.join(config.root, 'public')))
app.use('/files', resumable(undefined, undefined, db))
}

Continue reading...