Also, in addition to @francislavoie’s comment, I still don’t see you setting any Access-Control-Allow-Origin header anywhere. I can see an origin header being set with that content, but that’s not going to cover it.
Also, in addition to @francislavoie’s comment, I still don’t see you setting any Access-Control-Allow-Origin header anywhere. I can see an origin header being set with that content, but that’s not going to cover it.