What you need to know
CORS is a browser rule for cross-origin responses. It does not authenticate users or block non-browser clients, so it should be combined with proper access controls.
How to apply it
List the exact frontend origins that need access, allow only required methods and headers, and handle preflight requests. Keep production and local development origins explicit.
Common mistake to avoid
Do not use a wildcard origin with credentials. CORS is not a security boundary for your API and should not replace authentication.