混合app中客户端允许发送 cookie后，服务器跨域必须设置域名怎么办？

Question

客户端代码：

let xhr = new XMLHttpRequest();
xhr.open('post' , url , true);
xhr.withCredentials = true;
xhr.send(null);

服务端：

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Credentials: true');

客户端报错：

Access to XMLHttpRequest at 'http://t.com/index.php' from origin 'null' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

请求头也变成没有完整信息的请求头了：

请问，混合 app 开发方式下，如何允许客户端携带 cookie ？？

Answer 1

header('Access-Control-Allow-Origin: *');

这个一句不能返回*，应该是具体的域名，比如：

header('Access-Control-Allow-Origin: http://t.com');