Browser clients call a protected API from another origin and encounter CORS failures. What should the developer configure?

1. An appropriate CORS policy alongside the independent authentication and authorization controls.
2. Permit every origin and credential combination without reviewing browser rules.
3. Change the database backup schedule.
4. Remove authentication because CORS replaces it.