Ory - Hydra 2 does not send CORS headers in response to OPTIONS preflight requests.

## The fix

[aeneasr (maintainer)]: For preflight (OPTIONS) requests, Hydra cannot tell which OAuth2 client is calling because OPTIONS carries no authorization headers, so client-specific allowed_cors_origins cannot help there. Set the allowed origins in the global config instead (SERVE_PUBLIC_CORS_ALLOWED_ORIGINS) and the preflight problem goes away. Client-specific origins only apply to non-preflight requests.

Thread: gh:ory/hydra#3795