Joe

Thanks @shinima @Andarist for confirming the exception. Yes it would be great if the exception didn't get swallowed or even avoid it altogether. In my real project, I was able...

Yep, by default "cors()" set the Access-Control-Allow-Origin to "*" which Chrome will reject when the request was made with "credentials" flag enabled. It throws error something like: `A wildcard '*'...