Use CORS middleware app-wide.