A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true

Access-Control-Allow-Origin-and-credentials.js

Request error : 
XMLHttpRequest cannot load https://subdomain.domain.com/api/campaign/auth/twitter. Response to preflight request doesn't pass access control check: A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'https://subdomain2.domain.com' is therefore not allowed access.

Solution :
var whitelist = ['https://subdomain.domain.com', 'https://subdomain2.domain.com'];
// All api requests
app.use(function (req, res, next) {
    var origin = req.headers.origin;
    if(whitelist.indexOf(origin) > -1){
      res.header('Access-Control-Allow-Origin', origin);
    }
    // CORS headers
    //res.header("Access-Control-Allow-Origin", "*"); // restrict it to the required domain
    res.header("Access-Control-Allow-Credentials", true);
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
    // Set custom headers for CORS
    res.header('Access-Control-Allow-Headers', 'Content-type,Accept,X-Access-Token,X-Key,If-Modified-Since,Authorization');
    if (req.method == 'OPTIONS') {
        res.status(200).end();
    } else {
        next();
    }
});