CORS wide open in Next.js

const allowed = new Set([
  "https://your-app.example",
]);

export function cors(request: Request): Headers {
  const headers = new Headers();
  const origin = request.headers.get("origin");
  if (origin && allowed.has(origin)) {
    headers.set("Access-Control-Allow-Origin", origin);
    headers.set("Vary", "Origin");
    headers.set("Access-Control-Allow-Credentials", "true");
  }
  return headers;
}

If the route does not use cookies, you often do not need CORS credentials at all. Same-origin fetches from your own Next.js pages do not need a CORS middleware. Delete the "allow all" helper if nothing cross-origin is supposed to call you.