fix: plugin cost (#3533)

packages/service/common/middle/cors.ts

@@ -3,10 +3,13 @@ import NextCors from 'nextjs-cors';
 
 export async function withNextCors(req: NextApiRequest, res: NextApiResponse) {
   const methods = ['GET', 'eHEAD', 'PUT', 'PATCH', 'POST', 'DELETE'];
+
+  const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(',');
   const origin = req.headers.origin;
+
   await NextCors(req, res, {
     methods,
-    origin: origin,
+    origin: allowedOrigins || origin,
     optionsSuccessStatus: 200
   });
 }