CORS Configuration

Summary

Properly configuring which origins, methods and headers your API allows via CORS — too permissive (a wildcard everywhere) is a security smell, too strict breaks legitimate clients.

• 1Configure CORS to allow only your actual frontend's origin, not a wildcard.
• 2Learn which requests need CORS at all (browser-to-API) vs which don't (server-to-server).
• 3Test that a disallowed origin is correctly blocked.