cors-configuratorlisted

Fix the specific, maddening case where a request works from curl or Postman but the browser blocks it with a CORS error. CORS is enforced by the browser, not the server — so the failure is always that the server isn't returning the response headers the browser requires for a cross-origin request. This skill reads the exact error, determines what the browser is asking for, and sets the minimal correct headers on the server, without disabling the protection or opening the API to every origin. > [!NOTE] > CORS is a browser policy, not a server-side security control. Loosening it doesn't make your API safer or more dangerous to non-browser clients — but a wildcard-with-credentials or reflect-any-origin "fix" does expose authenticated users to malicious sites. Scope it to the origins you actually serve. ## When to use this skill - A browser `fetch`/XHR fails with "No 'Access-Control-Allow-Origin' header" or "…does not pass access control check", but the same endpoint works from curl. - A request started failing after you added `Authorization` headers, custom headers, cookies, or switched to `PUT`/`DELETE` (it became preflighted). - The preflight `OPTIONS` request returns 404/405 or the wrong headers. - You set `Access-Control-Allow-Origin: *` and it broke once credentials were involved. ## Instructions 1. **Read the exact error and the request.** Get the precise browser console message and the request's origin, method, and headers. The error text names what's missing (origin