getCorsOptions = () => {
  // enable all cors
  const enableAllcors = _get(Meteor.settings, 'apolloServer.corsEnableAll', false);
  if (enableAllcors) return true; // will allow all distant queries DANGEROUS
  // enable only a whitelist or nothing
  const corsWhitelist = _get(Meteor.settings, 'apolloServer.corsWhitelist', []);
  const corsOptions =
    corsWhitelist && corsWhitelist.length
      ? {
          origin: function(origin, callback) {
            if (!origin) {
              callback(null, true); // same origin
            } else if (corsWhitelist.indexOf(origin) !== -1) {
              callback(null, true);
            } else {
              callback(new Error(`Origin ${origin} not allowed by CORS`));
            }
          },
          credentials: true,
        }
      : process.env.NODE_ENV === 'development'; // default behaviour is activating all in dev, deactivating all in production
  return corsOptions;
}
setup CORS
 @see https://expressjs.com/en/resources/middleware/cors.html
 @see https://www.apollographql.com/docs/apollo-server/api/apollo-server/#apolloserver
 In Apollo, default cors is defined in packages/apollo-server/src/index.ts, it's too permissive so we use "false" in production