remove allow_credentials

docs_src/cors/tutorial001.py

@@ -13,9 +13,8 @@ origins = [
 app.add_middleware(
     CORSMiddleware,
     allow_origins=origins,
-    allow_credentials=True,
-    allow_methods=["GET"],
-    allow_headers=["Authorization", "X-Example"],
+    allow_methods=["*"],
+    allow_headers=["*"],
 )
 
 

tests/test_tutorial/test_cors/test_tutorial001.py

@@ -18,11 +18,7 @@ def test_cors():
         response.headers["access-control-allow-origin"]
         == "https://localhost.tiangolo.com"
     )
-    assert response.headers["access-control-allow-headers"] == (
-        "Accept, Accept-Language, "
-        "Authorization, Content-Language, "
-        "Content-Type, X-Example"
-    )
+    assert response.headers["access-control-allow-headers"] == "X-Example"
 
     # Test standard response
     headers = {"Origin": "https://localhost.tiangolo.com"}