We use these settings:
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<ID>S3Drive</ID>
<AllowedOrigin>https://web.s3drive.app</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>HEAD</AllowedMethod>
<AllowedMethod>POST</AllowedMethod>
<AllowedMethod>PUT</AllowedMethod>
<AllowedMethod>DELETE</AllowedMethod>
<MaxAgeSeconds>3600</MaxAgeSeconds>
<ExposeHeader>etag</ExposeHeader>
<ExposeHeader>x-amz-meta-x-amz-key</ExposeHeader>
<ExposeHeader>x-amz-meta-x-amz-iv</ExposeHeader>
<ExposeHeader>x-amz-meta-x-amz-cek-alg</ExposeHeader>
<ExposeHeader>x-amz-meta-x-amz-wrap-alg</ExposeHeader>
<ExposeHeader>x-amz-meta-x-amz-key-v2</ExposeHeader>
<ExposeHeader>x-amz-meta-x-amz-tag-len</ExposeHeader>
<ExposeHeader>x-amz-meta-x-amz-unencrypted-content-length</ExposeHeader>
<ExposeHeader>x-amz-version-id</ExposeHeader>
<ExposeHeader>x-amz-meta-key</ExposeHeader>
<ExposeHeader>x-amz-meta-iv</ExposeHeader>
<ExposeHeader>x-amz-meta-chunk</ExposeHeader>
<ExposeHeader>x-amz-meta-cek-alg</ExposeHeader>
<ExposeHeader>x-amz-meta-s3drive</ExposeHeader>
<ExposeHeader>x-amz-meta-mtime</ExposeHeader>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
but app in principle should configure it for you. If "Set up CORS" button doesn't work for you on Web, then try configuring bucket on desktop/mobile and click: Set up CORS from the Profile settings.
Our experience was that Backblaze CORS settings configured using their website haven't worked, I am not sure if they have fixed that already.