Which response contract lets an allowed frontend read a cross-origin response to fetch wi…

Which response contract lets an allowed frontend read a cross-origin response to fetch with credentials set to include?

1. An exact matching Access-Control-Allow-Origin plus Access-Control-Allow-Credentials set to true
2. Access-Control-Allow-Origin set to an asterisk, with no other response header
3. Access-Control-Allow-Credentials set to true, with no Access-Control-Allow-Origin