After the preflight request, the request header disappears, more precisely, the value changes to *, how to make sure that the browser does not swear?

Question

Backend

Error in console:

Access to fetch at 'http://localhost:6529/graphql' from origin 'http://localhost:3000' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.