How to configure CORS for withCredentials: true?

Question

Angular

Hello, I have an api that has sessions.
The problem is that the front does not receive cookies that contain the session key, so the session does not work.
Requests sent with Postman, Swagger - work.
Requests from the front (Angular):

this.http.post('https://webcoin-dev.azurewebsites.net/api/User/signin/'+this.phone, null, { withCredentials: true })
      .subscribe(resp => {})

In Cors, I turned everything on and off one at a time, tried to twist them in different ways.

app.UseCors(s =>
            {
                s.AllowAnyHeader();
                s.AllowAnyMethod();
                s.AllowCredentials();
                s.AllowAnyOrigin();
            });

has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
I googled that if there is "AllowCredentials" you need to specify Origin not "*", but a specific Host, which I did, and the error went away, but the front still did not receive cookies, and the next request that reads the value from the cookie from the previous request gets empty as if the session is new.
I have a simple two-step authorization
1) I enter a phone number, I write down the phone number and code in the session, I send the code via SMS
2) I validate the code and from that moment I believe that the phone is valid, and the person has it - I give the JWT token
Who came across help! Already all Google queries are marked as read.
If I don’t find a solution to this, I will have to do this authorization through the cache, and a third-party cache, because there will be several application instances. And sessions would allow us to refuse an external service for the cache.

Answer 1

Who faced help! Already all Google queries are marked as read.

- You have to run on them for two more days. ;)
The main joke is that CORS is configured not on the client, but on the server you want to contact. Until a site that is third-party in relation to your application does not allow CORS to be done to itself - that's it! No CORS settings in the browser will help. Either make a re-request from your web server (from the backend) or go to that site for a bow so that it turns on CORS on the address of your site. It seems like there are no more Feng Shui options.
UPDATE:
If a third-party site is yours, then read a good article on how to set it up: https://learn.javascript.ru/xhr-crossdomain
UPDATE 01:
Actually, the main joke is why such a scheme was made - requests always go to a site with cookies, and if an attacker sent a request from his page to the same https://facebook.com, then he could use the api of this site with your profile data. Well, wouldn't you like that? Therefore, this CORS is set exactly on the sites that you want to contact via CORS, and for this reason it is disabled there.

Answer 2

I googled that if there is "AllowCredentials" you need to specify Origin not "*", but a specific Host, which I did

This is what the error says and this is what should have been solved - try again and discard the headers