OptionalallowedAllowed request headers
OptionalcredentialsWhether to include credentials (cookies, authorization)
OptionalexposedExposed headers in response
OptionalmaxMax age of preflight result (in seconds)
OptionalmethodsAllowed methods
OptionalonOptional callback to modify response before sending
OptionaloriginAllowed origins (strings or regex)
Configuration for CORS middleware