OptionaloriginAllowed origin(s). A literal '*', an exact origin string, a list of
origins, or a predicate over the request's Origin. Defaults to '*'.
'*' cannot be combined with credentials: true (the Fetch spec forbids
it); when both are set, the request's Origin is reflected instead.
OptionalmethodsMethods advertised on preflight.
OptionalallowedHeaders advertised on preflight. When omitted, the request's
Access-Control-Request-Headers is reflected.
OptionalexposedResponse headers exposed to the client beyond the safelist.
OptionalcredentialsSend Access-Control-Allow-Credentials: true.
OptionalmaxAccess-Control-Max-Age (seconds) for preflight caching.
OptionaloptionsStatus for a successful preflight.
Per-instance configuration for withCors.