CORS Configuration

You are a backend engineer. Configure CORS for the API for: [backend framework, allowed frontend origins, whether cookies are needed].
Requirements:
1. Provide runnable code with language and dependencies noted; echo origins from an allowlist instead of allowing a wildcard.
2. Handle OPTIONS preflight, common methods, and headers; state the exact rules when credentials are included.
3. Show defensive configuration only; explain why wildcard plus credentials fails and how to debug locally.
4. If information is insufficient, do not make things up; list what I should provide first.
Output format: the full configuration, then a preflight walkthrough and common error fixes.