bug :Invalid and unsafe CORS configuration (allow_origins=["*"] with allow_credentials=True)

[yomo40]

The backend CORS middleware is configured with allow_origins=["*"] and allow_credentials=True. Meanwhile, some users on isuue have reported cross-origin errors, with browsers explicitly indicating a missing Access-Control-Allow-Origin.