CORS (Cross-Origin Resource Sharing) is the mechanism by which a server allows a browser to read responses coming from another origin (scheme, domain, and port). The server responds with Access-Control-Allow-* headers and handles OPTIONS preflight requests. You allow a precise list of origins, never * with credentials.
Example
Access-Control-Allow-Origin: https://app.exemple.fr