magento2-cors

Allows fine-grained CORS policy setting via configuration files for origins, methods, and headers, as detailed in the configuration documentation.

Implements all standard CORS headers including Access-Control-Allow-Credentials and Access-Control-Max-Age, ensuring compliance with browser security standards.

Designed with secure defaults to prevent misconfiguration, reducing the risk of unauthorized access, as emphasized in the security documentation.

Includes Vary: Origin header to maintain proper HTTP caching behavior with CORS, preventing cache poisoning issues as noted in the features.