How to set CORS of static resources

this my config

```js
app.use(convert(require('koa-static')(__dirname + '/public')))
app.use(cors({
origin: function (ctx) {
return '*';
},
exposeHeaders: ['WWW-Authenticate', 'Server-Authorization'],
maxAge: 5,
credentials: true,
allowMethods: ['GET', 'POST', 'DELETE'],
allowHeaders: ['Content-Type', 'Authorization', 'Accept'],
}))
```
Error reporting when I access files under public
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Start with the two app.use entry points shown in the issue, comparing the koa-static and cors middleware order. Reproduce a request for a file under public and inspect its response headers; done means the intended static-resource response includes the required CORS headers without breaking the stated credentials and origin settings.

Written by the indexing model from the issue text.