Replace CORS origin reflection with an allow-list on Shopify
Why it matters
The server copies any Origin into Access-Control-Allow-Origin and allows credentials, so any website a logged-in visitor opens can read your responses with their cookies. Only origins on a fixed list should ever get that permission.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify sets the storefront's response headers and stores cannot change their CORS policy. If an app adds these headers on your domain, contact the app's developer.
Related
Scan your domain to see whether this applies to you.