feat(server)!: improve default options for CORSPlugin (#143)

Use default * for allow origin can security risk in some cases

Author: dinwwwh

packages/server/src/plugins/cors.ts

@@ -18,14 +18,10 @@ export class CORSPlugin<TContext extends Context> implements Plugin<TContext> {
 
   constructor(options?: Partial<CORSOptions<TContext>>) {
     const defaults: CORSOptions<TContext> = {
-      origin: '*',
+      origin: origin => origin,
       allowMethods: ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH'],
     }
 
-    if (options?.credentials) {
-      defaults.origin = origin => origin
-    }
-
     this.options = {
       ...defaults,
       ...options,