CORS for a Browser Client With Cookies

Configure CORS for a browser app on one origin that calls an API on another and sends a cookie. Do not copy a wildcard snippet. ORIGINS App: [ORIGIN] API: [ORIGIN] Cookie: [NAME, SAME-SITE PLAN] Methods: [LIST] Headers the browser will send: [LIST] DELIVER 1) The exact allowlist. Echo the request origin only if it is in the list. Never Access-Control-Allow-Origin: * together with credentials. 2) Allow-Credentials, the allowed methods and headers, and max-age for the preflight. 3) The cookie attributes that can work cross-site (SameSite=None; Secure) and the warning that this is a broader cookie. Prefer a same-site setup if I can change the domains, and say when that is the better design. 4) What CSRF means once a cookie is sent cross-site, and the control we pair with it (a token, or a same-site cookie plus a custom header). 5) A failing test: an origin not on the list gets no allow header. Do not reflect the Origin header unconditionally. Do not add CORS to "fix" a mobile app that is not a browser.