混合app中客户端允许发送 cookie后，服务器跨域必须设置域名怎么办？

Question

客户端代码：let xhr = new XMLHttpRequest();xhr.open('post' , url , true);xhr.withCredentials = true;xhr.send(null);服务端：header('Access-Control-Allow-Origin: *');header('Access-Control-Allow-Credentials: true');客户端报错：Access to XMLHttpRequest at 'http://t.com/index.php' from origin 'null' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.请求头也变成没有完整信息的请求头了：请问，混合 app 开发方式下，如何允许客户端携带 cookie ？？