Should default options allow null origin?

When using the default options, as the docs describe, without defining an origin, the response will set Access-Control-Allow-Origin to the request Origin header.

Enable cors with default options:
  origin: request Origin header

But if hit with a request that sets Origin: null, then the response will be Access-Control-Allow-Origin: null.

There's a lot of sources that say don't do this...
https://w3c.github.io/webappsec-cors-for-developers/#avoid-returning-access-control-allow-origin-null

I'm not really an expert in this area, but would there be a better default behavior than..

// https://github.com/koajs/cors/blob/master/index.js#L66
origin = options.origin || requestOrigin;

... if the requestOrigin were null?

Start with index.js around line 66, then read the linked W3C guidance to understand the security implications of reflecting a null Origin. Review the existing middleware behavior and tests, and clarify the intended default policy before defining completion as an agreed behavior with regression coverage.