3387409 - CORS Error for ASM user when searching for customers after login

After setup ASM for Composable Storefront, even relevant CORS configuration is set as ASM setup document instructs, when end user login with the ASM user and tries searching for the customer, there is still CORS error shown in browser console with below pattern.

Access to XMLHttpRequest at 'https://backendapi.xxxxxx.model-t.cc.commerce.ondemand.com/assistedservicewebservices/customers/search?xxxxxx' from origin 'https://jsapps.xxxxxx.model-t.cc.commerce.ondemand.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental. 

Composable Storefront, spa, spartacus, CORS, ASM, search, 404, 500 , KBA , CEC-SPA , SAP Commerce Cloud Spartacus , Problem