Fix CORS, correctly.

CORS errors are maddening because the fix is fiddly and easy to get subtly wrong — especially the wildcard-plus-credentials trap that silently breaks cookies. Pick your origins and target and get a config that actually works, with the preflight handling people forget.

The error that wastes an afternoon

Almost every developer has lost an afternoon to a CORS error — not because it's hard, but because the rules are precise and the failure messages are vague. The browser blocks the response, the network tab is cryptic, and the fix involves a preflight you didn't know you needed and a wildcard rule that quietly disables your cookies. Getting the config right once, for your actual stack, makes the whole class of problem go away.

CORS is one rule in your edge config, and like the rest of it — headers, TLS, rate limits — the work isn't setting it once, it's keeping it correct and consistent as the app and the hosts change. That standing correctness across the infrastructure you own is what a control plane is for.