Given a browser-based client failing cross-origin requests, identify the OOTB CORS policy (and its allowed origins/methods/headers configuration) as the correct gateway mechanism rather than hand-coding CORS headers in the flow.