REST API ignores PostgREST CORS settings, forcing Access-Control-Allow-Origin: *

# Bug report - [x] I confirm this is a bug with Supabase, not with my own application. - [x] I confirm I have searched the [Docs](https://docs.supabase.com), GitHub [Discussions](https://github.com/supabase/supabase/discussions), and [Discord](https://discord.supabase.com). ## Describe the bug Supabase appears to override the `Access-Control-Allow-Origin` header at the Cloudflare proxy level, forcing it to `*`, even when PostgREST is explicitly configured with a strict allowed origin. This makes it impossible to enforce strict CORS policies on the Supabase REST API, which is a requirement raised during a penetration test. ## To Reproduce 1. Attempt to configure strict CORS for the Supabase REST API. 2. Discover that Supabase does not expose a CORS configuration option for the REST API. 3. Apply the documented PostgREST configuration directly via SQL: ```sql ALTER ROLE authenticator SET pgrst.server_cors_allowed_origins = 'https://foo.example'; NOTIFY pgrst, 'reload config'; ``` 4. Confirm that the PostgREST configuration is successfully updated. 5. Make a request to the Supabase REST API from a browser. 6. Observe that the response header `Access-Control-Allow-Origin` is still set to `*`. ## Expected behavior When `pgrst.server_cors_allowed_origins` is set to a specific origin, the Supabase REST API should return that exact value in the `Access-Control-Allow-Origin` response header, rather than `*`. This would allow developers to enforce strict CORS policies as required by security audits and penetration tests. ## Screenshots Not applicable. ## System information - OS: Not relevant (issue occurs server-side) - Browser (if applies): Any (observed via browser network inspection) - Version of supabase-js: Not applicable - Version of Node.js: Not applicable ## Additional context - The PostgREST configuration change is confirmed to take effect internally. - The `Access-Control-Allow-Origin: *` response appears to be injected or overridden by Supabase’s Cloudflare proxy…