CORS headers not present on API requests

[G-Rath]

Support was added in #3222 but looks to have gone again:

❯ curl -sSL -D - -o /dev/null -d '{"commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f"}'     "https://api.test.osv.dev/v1/query"
HTTP/2 200
content-type: application/json
grpc-accept-encoding: identity, deflate, gzip
traceparent: 00-210d85c7cf9eb9bb84e75dc11400a117-28a4a0952230e232-01
x-cloud-trace-context: 210d85c7cf9eb9bb84e75dc11400a117/2928642220081865266;o=1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
grpc-status: 0
grpc-message:
x-envoy-decorator-operation: ingress QueryAffected
date: Tue, 21 Apr 2026 04:06:42 GMT
server: Google Frontend
content-length: 23737


~ via  v22.18.0 via 🐍 v3.10.12 via 💎 took 6s
❯ curl -sSL -D - -o /dev/null -d '{"commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f"}'     "https://api.osv.dev/v1/query"
HTTP/2 200
content-type: application/json
grpc-accept-encoding: identity, deflate, gzip
x-cloud-trace-context: eb4a1975bab8ddf16474405225401bc0/10745446689491783077
traceparent: 00-eb4a1975bab8ddf16474405225401bc0-951f7ed5100e0da5-00
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
grpc-status: 0
grpc-message:
x-envoy-decorator-operation: ingress QueryAffected
date: Tue, 21 Apr 2026 04:23:49 GMT
server: Google Frontend
content-length: 24889

[another-rex]

You need to include the Origin header for a CORS response. This I believe is sent by browsers when making cross site requests automatically when using fetch.