CORS allowlist middleware (no wildcard surprises)

                  package middleware

import (
  "net/http"
)

func CORS(allowed map[string]struct{}) func(http.Handler) http.Handler {
  return func(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
      origin := r.Header.Get("Origin")
      if origin != "" {
        if _, ok := allowed[origin]; ok {
          w.Header().Set("Access-Control-Allow-Origin", origin)
          w.Header().Set("Access-Control-Allow-Methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS")
          w.Header().Set("Access-Control-Allow-Headers", "Authorization,Content-Type,Idempotency-Key")
          w.Header().Set("Vary", "Origin")
        }
      }

      if r.Method == http.MethodOptions {
        w.WriteHeader(http.StatusNoContent)
        return
      }
      next.ServeHTTP(w, r)
    })
  }
}