title: Why do I get a CORS error when I've set Access-Control-Allow-Origin?
body: <h2>Problem</h2>
  
  <p>The <code>Access-Control-Allow-Origin</code> of the response header matches the request <code>Origin</code> header but I'm still getting the error
  <code>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://myappname.herokuapp.com/api/v1/products. (Reason: CORS request did not succeed).[Learn More]</code></p>
  
  <h2>Headers</h2>
  
  <p>Response Header</p>
  
  <pre><code>HTTP/1.1 308 PERMANENT REDIRECT
  Connection: keep-alive
  Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: authorization, content-type
  Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
  Access-Control-Allow-Origin: http://localhost
  Content-Length: 311
  Content-Type: text/html; charset=utf-8
  Date: Thu, 04 Apr 2019 10:03:39 GMT
  Location: http://mpappname.herokuapp.com/api/v1/products/
  Server: waitress
  Via: 1.1 vegur
  </code></pre>
  
  <p>Request Header</p>
  
  <pre><code>Host: mpappname.herokuapp.com
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate, br
  Access-Control-Request-Method: POST
  Access-Control-Request-Headers: authorization,content-type
  Referer: http://localhost/admin/main/products/create
  Origin: http://localhost
  DNT: 1
  Connection: keep-alive
  </code></pre>
  
  <h2>Background</h2>
  
  <p>The code that generates the headers is below but I'm more concerned with understanding why CORS preflight is rejecting this. This is for a flask api with a products CRUD design and token based authentication.</p>
  
  <p>Cut version</p>
  
  <pre><code>from flask_cors import CORS
  
  def create_app(config_name):
      ...
      CORS(app, origins="http://localhost",
        allow_headers=["Content-Type", "Authorization", "Access-Control-Allow-Credentials"],
        supports_credentials=True)
      ...
      return app
  </code></pre>
  
  <p>Full version</p>
  
  <pre><code>from flask import Flask
  from config import config
  from flask_sqlalchemy import SQLAlchemy
  from flask_cors import CORS
  db = SQLAlchemy()
  
  def create_app(config_name):
      app = Flask(__name__)
      app.config.from_object(config[config_name])
      config[config_name].init_app(app)
  
      db.init_app(app)
      CORS(app, origins="http://localhost",
        allow_headers=["Content-Type", "Authorization", "Access-Control-Allow-Credentials"],
        supports_credentials=True)
  
      from .main import main as main_blueprint
      app.register_blueprint(main_blueprint)
  
      from .api import api as api_blueprint
      app.register_blueprint(api_blueprint, url_prefix='/api/v1')
  
      return app
  </code></pre>