title: response to preflight doesn't pass access control check
body: <p>I have a simple <code>flask</code> server</p>
  
  <pre><code>import pdb
  
  from flask import Flask, jsonify, abort, make_response, request, send_from_directory
  from flask_cors import CORS, cross_origin
  from pprint import pprint
  
  import argparse
  
  from mylib.mylib_rest_api import ProcessRestApiRequest
  
  
  DEBUG=True
  app = Flask(__name__)
  CORS(app)
  
  parser = argparse.ArgumentParser(description='Run the server')
  
  parser.add_argument('--ip-address', default='127.0.0.1', help='Server IP Address. Default: %(default)s')
  parser.add_argument('--port', type=int, default=8081, help='Server port')
  
  args = parser.parse_args()
  
  @app.errorhandler(404)
  def not_found(error):
      return make_response(jsonify({'error': 'Not found'}), 404)
  
  def do_pre_serve_actions():
      if not request.json: abort(400)
      # Extract the data
      dictReq = request.get_json(force=True)
      if DEBUG:
          pprint('dictReq: '+str(dictReq))
      return dictReq
  
  def do_post_serve_actions(dictResp):
      if DEBUG:
          pprint("dictResp: "+str(dictResp))
      dictJSONResp = jsonify(dictResp)
      objRespADF = make_response(dictJSONResp)
      return objRespADF
  
  @app.route('/&lt;target&gt;', methods=['POST'])
  def serve(target):
      dictReq = do_pre_serve_actions()
      dictResp = ProcessRestApiRequest(dictReq, target)
      return do_post_serve_actions(dictResp)
  
  if __name__ == '__main__':
      app.run(debug=DEBUG, host=args.ip_address, port=args.port)
  </code></pre>
  
  <p>This is how a request looks like:</p>
  
  <pre><code>makeRequestAndSendData(xhr, dict) {
      dict['Interface'] = this.getChipInterface();
      var data = JSON.stringify(dict);
      var url = this.server.getUrl();
  
      console.log("url: "+url);
      console.log("Request Dictionary:");
      console.log(dict);
  
      xhr.open("POST", url, true);
      xhr.setRequestHeader("Access-Control-Allow-Origin", "*");
      xhr.setRequestHeader("Access-Control-Allow-Headers","*");
      xhr.setRequestHeader("Access-Control-Allow-Credentials", "true");
      xhr.setRequestHeader("Content-type","application/json");
      xhr.send(data);
  }
  </code></pre>
  
  <p>Here is what I'm getting:</p>
  
  <blockquote>
    <p>Failed to load <a href="http://192.168.0.132:8084/mychip" rel="nofollow noreferrer">http://192.168.0.132:8084/mychip</a>: Response to preflight
    request doesn't pass access control check: The
    'Access-Control-Allow-Origin' header has a value 'null' that is not
    equal to the supplied origin. Origin 'null' is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>What am I doing wrong? I've looked everywhere online and it seems like it got everything I need. Am I missing something?</p>