fix(vite): use h3 cors handler for vite routes only

[danielroe]

🔗 Linked issue

resolves #22512
resolves #23962

❓ Type of change

• 📖 Documentation (updates to the documentation or readme)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

This turns off vite's cors handler (https://github.com/expressjs/cors) by default, in preference to using h3's handler only for routes to be transformed by vite. This should enable us to avoid CORS headers on Nuxt/Nitro endpoints that aren't handled by vite.

If the user configures vite.server.cors then this is respected.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[pi0]

This is good imo for the fix but also we could find a way to disable vite cors overrides entirely allow both consistent behavior when h3 util / route rule used (route rule is normalized to cors headers not using utility) and also user custom behavior

[danielroe]

I think that is what this fix does. It does disable vite cors header handler entirely and only adds cors headers for vite routes. But maybe I'm misunderstanding you?

[pi0]

Indeed it does disable vite feature and directly adds OPTIONS handler via a nuxt default behavior. What i meant was to avoid this too, in next steps iterating with nitro.

[danielroe]

Ah, I see. But Nuxt only does this for routes that are handled by vite, leaving normal nitro routes unhandled.

What's more, a route rule wouldn't work as the routes are not always predictable.