The CORS policy accepts any request header from any origin

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Headers: Authorization, Content-Type
Vary: Origin

# http scope. The map is the allow-list: an origin that is not a key here gets "".
map $http_origin $cors_origin {
	default                     "";
	"https://app.example.com"   "https://app.example.com";
	"https://admin.example.com" "https://admin.example.com";
}

# Credentials are granted only when the origin matched.
map $cors_origin $cors_credentials {
	default "";
	~.      "true";
}

server {
	location /api/ {
		add_header Access-Control-Allow-Origin      $cors_origin always;
		add_header Access-Control-Allow-Credentials $cors_credentials always;
		add_header Access-Control-Allow-Methods     "GET, POST, OPTIONS" always;
		add_header Access-Control-Allow-Headers     "Authorization, Content-Type" always;
		add_header Access-Control-Max-Age           "600" always;
		add_header Vary                             "Origin" always;

		if ($request_method = OPTIONS) {
			return 204;
		}
	}
}

<IfModule mod_headers.c>
	# The capture group is the allow-list: only these exact origins set the variable.
	SetEnvIf Origin "^(https://app\.example\.com)$"   CORS_ORIGIN=$1
	SetEnvIf Origin "^(https://admin\.example\.com)$" CORS_ORIGIN=$1

	Header always set Access-Control-Allow-Origin      "%{CORS_ORIGIN}e" env=CORS_ORIGIN
	Header always set Access-Control-Allow-Credentials "true"            env=CORS_ORIGIN
	Header always set Access-Control-Allow-Methods     "GET, POST, OPTIONS" env=CORS_ORIGIN
	Header always set Access-Control-Allow-Headers     "Authorization, Content-Type" env=CORS_ORIGIN
	Header always set Access-Control-Max-Age           "600"             env=CORS_ORIGIN

	# Unconditional: the response varies by Origin whether or not this one matched.
	Header always append Vary Origin
</IfModule>

@allowed_origin header Origin https://app.example.com

header @allowed_origin {
	Access-Control-Allow-Origin "https://app.example.com"
	Access-Control-Allow-Credentials "true"
	Access-Control-Allow-Methods "GET, POST, OPTIONS"
	Access-Control-Allow-Headers "Authorization, Content-Type"
	Access-Control-Max-Age "600"
}

# Unconditional, so caches key on Origin even for the unmatched response.
header Vary Origin

@preflight method OPTIONS
respond @preflight 204

const ALLOWED_ORIGINS = new Set([
  'https://app.example.com',
  'https://admin.example.com',
]);

app.use((req, res, next) => {
  // Set unconditionally: the answer depends on Origin even when it is refused.
  res.vary('Origin');

  const origin = req.headers.origin;
  if (origin !== undefined && ALLOWED_ORIGINS.has(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
    res.setHeader('Access-Control-Allow-Credentials', 'true');
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
    res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
    res.setHeader('Access-Control-Max-Age', '600');
  }
  if (req.method === 'OPTIONS') return res.sendStatus(204);
  next();
});

Rules → Overview → Create rule → Response Header Transform Rule (path as at 2026-09), with an expression that tests the request Origin against a fixed list, e.g.
  http.request.headers["origin"][0] in {"https://app.example.com" "https://admin.example.com"}
and a matching rule that always sets Vary: Origin.