Is it ever acceptable to use `Access-Control-Allow-Origin: *` in a production environment?

Generally, no. While `Access-Control-Allow-Origin: *` is the simplest way to resolve CORS issues, it's a significant security risk in production. It allows *any* website to access your API, potentially exposing sensitive data. It's best to explicitly specify the allowed origins for your API to minimize the attack surface. Only use `*` for development or testing purposes, and never in a live production environment.