HTTP headers / response header
Access-Control-Allow-Credentials: true
Permits cross-origin requests to include cookies/credentials — requires the JS side to set credentials: "include".
Incompatible with Allow-Origin: * — you must echo the exact Origin, which is the part everyone gets wrong first.
The fastest way to see what Access-Control-Allow-Credentials is actually doing is to send the request and read both sides raw — ReqPad shows auto-generated and custom headers for every request, on all six protocols, with history. Related references: status codes · WWW-Authenticate · Content-Encoding · Transfer-Encoding · ETag · Last-Modified · Expires
Build the request, send it, read raw headers and timing — from your iPhone. Free to start.