KojoEnch

sub vcl_deliver {
  if (req.http.host == "my.wonderful.cms") {
    set resp.http.Access-Control-Allow-Origin = "https://my.beautiful.app";
    set resp.http.Access-Control-Allow-Methods = "GET, POST, PATCH, OPTIONS";
    set resp.http.Access-Control-Allow-Headers = "Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token, Authorization, Access-Control-Allow-Origin, Access-Control-Allow-Credentials";
  }
}
# More in https://www.w3.org/TR/2020/SPSD-cors-20200602/#syntax