diff --git a/weed/s3api/s3api_server.go b/weed/s3api/s3api_server.go
index bb82c86c7..5d113c645 100644
--- a/weed/s3api/s3api_server.go
+++ b/weed/s3api/s3api_server.go
@@ -146,9 +146,7 @@ func (s3a *S3ApiServer) handleCORSOriginValidation(w http.ResponseWriter, r *htt
 	w.Header().Set("Access-Control-Expose-Headers", "*")
 	w.Header().Set("Access-Control-Allow-Methods", "*")
 	w.Header().Set("Access-Control-Allow-Headers", "*")
-	if s3a.option.AllowCredentials {
-		w.Header().Set("Access-Control-Allow-Credentials", "true")
-	}
+	w.Header().Set("Access-Control-Allow-Credentials", "true")
 	return true
 }