Interface CorsOptions

Allowed request headers for the preflight Access-Control-Allow-Headers response.

OMITTED (the default): an allowed origin's preflight ECHOES the request's Access-Control-Request-Headers, and the response carries Vary: Access-Control-Request-Headers.

The previous default was an empty list, which advertised no headers at all while methods defaulted to every standard verb — so the preflight offered POST/PUT/PATCH/DELETE and then refused content-type, the one header a JSON body needs. Every browser blocked every JSON request.

Echoing does not widen the security boundary: the ORIGIN allowlist is what decides, and it is unchanged — a caller that reaches this branch has already been admitted, and the header it is asking for is one it is already sending. Configure a list to deny everything outside it.

When true, emit Access-Control-Allow-Credentials: true.

Enable/disable CORS. Defaults to true when present.

Exposed response headers for Access-Control-Expose-Headers.

Max age (seconds) for preflight cache.

Allowed methods for preflight Allow-Methods header.

Origin configuration:

• true — reflect the request Origin header
• false — deny all cross-origin
• string — single allowed origin
• readonly string[] — allowlist of origins
• CorsOriginMatcher — dynamic matcher Default: empty allowlist (deny all cross-origin).