See if this helps: https://community.pega.com/knowledgebase/articles/security/configuring-csrf-protection

we can define the CORS policy for an API or REST service by specifying the allowed origins, allowed headers, exposed headers, allowed methods, credential usage, and preflight expiration time.

But Does CORS policy validates the content in the header. Is it possible to validate the payload ?

{"username":"<a href=\"jAvAsCrIpT:alert(1)\">X</a>","password":"xyz"}

{  "username": "waf",  "password": "select * from t1;"}