Pre-flight error about realworld

[c33k]

@apai4: you're right. It was a browser extension!

Someone installed the CORS Toggle in this machine's Google Chrome that I'm using and it was enabled, causing this problem. I didn't see it.

Thank you!

[c33k]

You could check if there's any code that enable CORS twice.

[apai4]

CORS is enabled (once) to allow any origin

$ curl -X OPTIONS -D - -H 'Origin: http://localhost:4000' -H "Access-Control-Request-Method: POST" https://conduit.productionready.io/api/users

includes

Access-Control-Allow-Origin: http://localhost:4000

as a response header (no extra wildcard). Changing the URL in the Origin request header will yield an Access-Control-Allow-Origin: response header with only that URL as the value.

What browser are you using? Could it be a browser extension that's interfering with that header?