Cors class final

Answers the cross-origin questions a browser asks before it will hand a response to JavaScript.

final app = Router()
  ..layer(Cors(origins: AllowedOrigins.only({'https://app.example'})))
  ..merge(routes);

Two kinds of request arrive. A preflight is OPTIONS carrying Access-Control-Request-Method; it is answered here and the handler never runs, because the browser is asking permission rather than making the call. Everything else runs normally and gets the allow headers added.

Put it at the top of the router. A layer below the one that rejects a request never runs, and a 401 without CORS headers reaches the browser as an opaque network error rather than as "you are not signed in".