fix(cors): avoid setting Access-Control-Allow-Origin if there is no matching origin

[uki00a]

The author should do the following, if applicable

• Add tests
• Run tests
• bun run format:fix && bun run lint:fix to format the code
• Add TSDoc/JSDoc to document the code

Even if the Origin header of a request does not match a origin specified by origin option, CORS middleware always sets Access-Control-Allow-Origin header. I don't see this as a serious problem, but in some cases it may unintentionally expose a server setting.

References

• https://github.com/expressjs/cors/blob/v2.8.5/test/test.js#L251-L262 - cors package seems not to set the Access-Control-Allow-Origin if the Origin header of a request does not match allowed origins
• https://fetch.spec.whatwg.org/#cors-check - A CORS check returns failure if the Access-Control-Allow-Origin header is missing
  • Currently, CORS middleware returns a origin specified by origin option as the Access-Control-Allow-Origin if the option does not match the Origin header of a request, so changes in this PR would have no particular negative impact

[uki00a]

This was originally added in #1129, but seems to have been lost at some point 👀