allow_origins

Optional. List of allowed origins (e.g., "https://example.com").

Default is often an empty list (no external origins). Use "*" only if you trust all origins, as that bypasses most restrictions.