CORS configuration that’s explicit (no *)

CORS configs have a habit of getting more permissive over time until you’re basically allowing any origin. I keep an explicit allowlist and handle credentials carefully. If you allow cookies, you can’t use * as the origin. I also keep preflight responses fast and cacheable by setting a maxAge. Logging unexpected origins in non-production helps you update the allowlist intentionally instead of widening it blindly. CORS isn’t an auth mechanism, but misconfiguring it makes auth bugs easier to exploit. Being explicit here keeps the security posture understandable and reduces surprises when you add a new frontend domain or preview environment.