Also, could you confirm that lines 20-23 of

packages/server/src/cors.ts

matches the following:

function isOriginAllowed(origin: string | undefined): boolean {
  const config = getConfig();
  return !!origin && (config.corsMode === 'open' || config.appBaseUrl.startsWith(origin));
}