Should Access-Control-Allow-Credentials be true by default?

[JakobKallin]

The default value for the credentials parameter is true, causing Access-Control-Allow-Credentials to be set to true. Should this really be the default? It seems to me that the purpose of the header is to require explicit opt-in (for developers who don't know about it or forget to consider it), but Rack CORS makes it opt-out instead.

[badnorseman]

Perhaps it would be a good idea to link to https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Access-Control-Allow-Credentials in documentation. It explains that origins * wouldn't work with credentials true.