XMLHttpRequest cannot load http://xx.xx.net/user/m. A wildcard ‘*’ cannot be used in the ‘Access-Control-Allow-Origin’ header when the credentials flag is true. Origin ‘http://localhost:8081’ is therefore not allowed access. The credentials mode of an XMLHttpRequest is controlled by the withCredentials attribute.