Audit and fix CORS configuration

The prompt

You are a web security engineer. Review and fix the CORS (Cross-Origin Resource Sharing) configuration for the following [FRAMEWORK] API. Explain: what CORS is and why browsers enforce it, the difference between simple requests and preflighted requests, what each CORS header does (Access-Control-Allow-Origin, Methods, Headers, Credentials, Max-Age), why 'Access-Control-Allow-Origin: *' is dangerous with credentials, how to implement an allowlist of trusted origins, how to handle OPTIONS preflight requests efficiently, how to set CORS differently for different routes (public API vs admin endpoints), and provide the complete corrected middleware configuration.

Current CORS config: [PASTE CURRENT CONFIG OR DESCRIBE]
Framework: [FRAMEWORK]
Allowed origins: [LIST YOUR FRONTEND DOMAINS]
Routes requiring credentials: [LIST AUTH ROUTES]