Hono's cors middleware must be registered before routes and answers preflight itself

The cors middleware answers preflight OPTIONS requests and adds response headers to actual requests. It only covers paths registered after it, so placing app.use('/api/*', cors()) below the API routes leaves preflight unanswered, and the browser reports a CORS failure with no matching entry in the server logs.

The defaults allow any origin without credentials. Setting credentials to true requires naming explicit origins, because browsers reject the wildcard in that combination, and the middleware does not warn about the mismatch. The origin option accepts a function, which is the safe way to reflect an allowlisted origin. Remember that an error response produced by an earlier middleware still needs the CORS headers, or the browser hides the real status from the client.