In a new post to his site Rob Allen shows you how to implement CORS in a Zend Expressive application through the use of a simple middleware wrapper that sends the appropriate headers.
As this is a standard Slim-Style PSR-7 middleware implementation, we need to wrap it for Expressive, so we make a factory. […] We then register this in our AppConfigProvider::getDependencies() by adding to the factories key.
He includes the code and configuration changes required to make it all work and includes example output of a request (with headers) from a curl call to the API. He also includes a section on working with JSON error responses and ProblemDetails for when there are issues related to the current CORS policy definition.