Cors behavour?

[ChillFish8]

I've been playing around accessing an API created with poem which has to go through CORS.

The issue I've ran into is with the following setup of cors:

            Cors::new()
                .allow_origins(["http://127.0.0.1:3000", "http://localhost:3000"])
                .allow_header("*")
                .allow_methods([Method::GET, Method::POST, Method::DELETE, Method::OPTIONS])
                .allow_credentials(true)

But when trying to access an endpoint with the required authorization. The preflight check gets rejected with 401 Unauthorized which of course causes a CORS failure on the browser.

Is this intended? Im not sure if I'm missing some setting on the cors middleware or something with CORS but this feels slightly un-natural.

[sunli829]

remove this line:

.allow_header("*")

[ChillFish8]

😓 Yup that would do it. 🙏 Thank you