The frontend calls fetch(url, { credentials: "include" }). The server replies with Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true. What happens?

The browser blocks the response. For a credentialed request, the server must send back the exact origin, such as Access-Control-Allow-Origin: https://app.com. A credentialed request is one that sends cookies or other credentials. If the server sends *, the browser rejects the response.

So "The request works and cookies are sent and accepted" is wrong. Access-Control-Allow-Credentials: true does not make * allowed.

The usual fix:
• check the Origin against an allowlist
• echo that origin back in Access-Control-Allow-Origin
• add Vary: Origin, so caches keep a separate copy per origin