Function cross_origin_layer 

pub fn cross_origin_layer() -> CorsLayer

The cross-origin policy on the public protocol surface.

Any origin, without credentials: the browser then never attaches a cookie, so a page on somebody else’s origin can present only what its own script holds — a bearer or DPoP token it was issued — which is how the atproto OAuth flow from a web app and every browser-based checker reaches a PDS. What it is layered on is decided in app_with_repos.