Function layer 

pub async fn layer(
    __arg0: State<AppState>,
    request: Request,
    next: Next,
) -> Response

Set the CORS headers on every response, and answer a preflight directly.

Access-Control-Allow-Origin follows upstream’s rule exactly (middlewares.js:407-412): the configured list defaults to ["*"], and if the request’s Origin is in the list it is echoed back, otherwise the first configured entry is sent. Echoing the request origin rather than sending the list is required, because the header takes one value and a browser compares it to its own origin.

Note what this does not do: there is no Access-Control-Allow-Credentials, because upstream does not send one. Parse carries its credentials in headers or in the body rather than in cookies, so the browser never needs to be told to attach them, and sending it would make * an illegal origin value.