abort method in Flask-Restful ignoring CORS options
When you trigger an abort, the error handler registered to the HTTP error code is automatically invoked, and the response is not actually served by your view function.
If you use the CORS middleware which is provided by Flask-Cors, instead of the decorator form, in the case of handled exceptions and aborts, the CORS headers will be injected as expected.
If an unhandled exception occurs, (E.G. there is an error in your code, and a 500 internal server error), Flask bypasses middleware, and after_request handlers are not run.
Full disclosure, I wrote Flask-Cors.