Why is my preflight response missing the credentials header?

First compare the preflight response at the public address with what the container itself returns. Send an OPTIONS request with the same Origin, Access-Control-Request-Method, and Access-Control-Request-Headers values the browser uses. If the container includes the credentials header but the public response does not, the difference points to an intermediary. If both omit it, keep debugging the Express middleware and its order.

Also check that the preflight is reaching the route and that the allowed origin is an exact match. A credentials-enabled browser request cannot use a wildcard origin, and the response needs Access-Control-Allow-Credentials: true.

If the public edge is generating or changing the OPTIONS response, adding more Express middleware won't fix what the browser receives. The comparison test is the useful part here, not guessing from the browser error alone. If the mismatch is confirmed, check the hosting provider's current guidance or support channel, since an app-level workaround may not exist for an edge-handled preflight.

One possible design change is to stop relying on cross-origin cookies and use an Authorization bearer token instead. That can avoid credentialed CORS requests, but it is not a drop-in fix: review how tokens are stored, protected, expired, and sent, and make sure your CORS policy allows the Authorization header and needed methods.