owOrigins:
      - exact: https://attack.example.com
...
</code></pre><p>In this case we explicitly allow a single origin; wildcards are common for non-sensitive pages.</p><p>Once we do this, a common mistake is to send a request like <code>curl bank.example.com -H "Origin: https://attack.example.com"</code>, and expect the request to be rejected.
However, curl and many other clients will not see a rejected request, because CORS is a browser constraint.
The CORS configuration simply adds <code>Access-Contro