Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the issue has not already been raised

Issue

The methods option, which sets the Access-Control-Allow-Methods response header, currently defaults to GET,HEAD,PUT,PATCH,POST,DELETE. This exposes unsafe methods that can modify server state to cross-origin requests, potentially leading to security vulnerabilities if not properly controlled.

It should instead default to CORS-safelisted methods GET,HEAD,POST or be disabled (which is the same as setting it to GET,HEAD,POST).

This would be a breaking change if implemented.