The middleware lists Origin as an allowed request header (see here and here). However, listing Origin is never necessary because that header is added to requests by the browser, never by the client. You can safely drop Origin from that list.