How to allow CORS?

I am deployng openserach cluster using docker compose

I set enviroment variable

and opensearch.yaml
http.cors.allow-origin: “*”

But id doesn’t seem to work

curl -H “User-Agent: Mozilla” -H “Origin: http://example.com” -i localhost:9200

HTTP/1.1 403 Forbidden
content-length: 0

How do I disable it?

@konst3 Did you disable the security plugin?