Fix

CORS (Access-Control-Allow-*)

CORS controls which origins can read responses from your server when browsers make cross-origin requests.

InfoCategory: cors
Recommended fix (safe defaults)
  • Allow only known origins (not '*') for authenticated endpoints.
  • Handle OPTIONS preflight correctly.
  • Set Access-Control-Allow-Credentials only when needed.
  • If you echo Origin, send Vary: Origin.