has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin'

На сервере:

 services.AddCors(options =>
        {
            options.AddPolicy("CorsPolicy", b =>
                {
                    b.AllowAnyOrigin()
                        .AllowAnyMethod()
                        .AllowAnyHeader()
                        .AllowCredentials();
                }
            );
        });

С сайта шлю запрос:

this._httpClient.get('API', { withCredentials: true }).subscribe(resut =>
  this.data = resut
);

Ловлю такое сообщение в консоле сайта:

Access to XMLHttpRequest at 'http://localhost:20019/api/' from origin 'https://localhost:44331' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute. [https://localhost:44331/] output

а на веб апи:

Что я делаю не так?