StreamResponse headers are flushed on prepare() before the CORS middleware can inject them. Resolve CORS headers up front using _cors_headers_for_origin() so the full set (including Access-Control-Allow-Origin) is present on SSE streams. Co-authored-by: ygd58 <ygd58@users.noreply.github.com>