I have this in ./config/middlewares.js:

module.exports = [
  'strapi::logger',
  'strapi::errors',
  'strapi::security',
  // 'strapi::cors',
  {
    name: 'strapi::cors',
    config: {
      origin: '*',
      methods: '*',
      headers: '*',
      credentials: true,
      maxAge: 86400,
    },
  },

  'strapi::poweredBy',
  'strapi::query',
  'strapi::body',
  'strapi::session',
  'strapi::favicon',
  'strapi::public',
];

but cross-origin requests are still barfed at by browser:

a.b.com/:1 Access to XMLHttpRequest at
‘https://a.b.com/api/header?populate[menuItems][populate]=*’ from
origin ‘https://c.b.com’ has been blocked by CORS policy: Request
header field access-control-allow-methods is not allowed by
Access-Control-Allow-Headers in preflight response.