Fix
CORS (Access-Control-Allow-*)
CORS controls which origins can read responses from your server when browsers make cross-origin requests.
InfoCategory: cors
Recommended fix (safe defaults)
- Allow only known origins (not '*') for authenticated endpoints.
- Handle OPTIONS preflight correctly.
- Set Access-Control-Allow-Credentials only when needed.
- If you echo Origin, send Vary: Origin.