server:
  cors:
    enabled: true
    allowedOrigins:
      - "${WEB_ORIGIN:-https://web.example}"
    allowedMethods: [GET, POST]
    allowedHeaders: [Authorization, Content-Type]
    exposedHeaders: [X-Request-ID]
    allowCredentials: false
    maxAge: 10m