I have yet another cors issue:

Access to XMLHttpRequest at '' from origin '' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

{"Content-Type" "application/edn"
             "Access-Control-Allow-Headers" "Content-Type"
             "Access-Control-Allow-Origin" "*"
             "Access-Control-Request-Method" "GET, OPTIONS"
             "Access-Control-Allow-Credentials" false}

@pshar10 It wants you to fix the request not the response.

Ah, further reading suggests that you can't provide "Access-Control-Allow-Credentials" false -- you must omit the header completely. Only a true value is permitted if the header is present.

(I was initially thinking you could change the request to opt out of credentials but reading more on that has just confused me 🙂 )

That solved credentials. But what about the new error? Access to XMLHttpRequest at 'http://localhost:3000/fetch-categories' from origin 'http://localhost:3689' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

That's the same error you posted above.

That's what I was responding to. Either you need to change the request (so credentials mode is not 'include') or change the headers you send back (to omit the allow credentials one).