CORS middleware official example is not working

[jca41]

Bug report

Describe the bug

The official guide for adding CORS to a next.js API route is not working correctly.

https://github.com/vercel/next.js/tree/canary/examples/api-routes-cors

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Follow the official guide and add CORS to a route
2. Set an example CORS config

{ origin: false, methods: ['POST'] }
3. npm run dev
4. Hit the API route with a disallowed HTTP method (ex. GET)

Expected behavior

The request should fail and i should see a CORS error on my browser console

System information

• OS:Linux
• Browser: Chrome
• Version of Next.js: 9.5.5
• Version of Node.js: 13.9.0

Additional context

Reported here also #16441 (comment)

[timneutkens]

#17814 (comment)

CORS only covers returning which methods are allowed, not actually blocking the methods.

[balazsorban44]

This issue has been automatically locked due to no recent activity. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.