OptionalallowedPermitted preflight header names (case-insensitive). Defaults to none; no wildcards.
OptionalcredentialsAllow browser credentials. Defaults to false; incompatible with origin: '*'.
OptionalexposedAdditional response headers browsers may read. Defaults to none; no wildcards.
OptionalmaxBrowser preflight cache duration in seconds. Defaults to zero.
OptionalmethodsOptional preflight allowlist, restricted to registered routes. No wildcards.
Exact serialized origins, '*', or a predicate evaluated once per HTTP request with Origin.
Server-wide CORS policy, enabled explicitly with ServerBuilder.useCors().