Flask-cors is not denying origins as configured
I don't think you're initializing the extension correctly with the App Factory pattern.
https://github.com/corydolphin/flask-cors/blob/master/flask_cors/extension.py#L131
Within app/main/__init__.py., try:
...cors = CORS()def create_app() app = Flask(__name__) cors.init_app(app, resources={r"/*": {"origins": r".*\.mydomain.com"}})...Full example: https://gitlab.com/testdriven/flask-react-auth/blob/master/services/users/project/init.py
Use this:
cors.init_app(app, resources={r"*": {"origins": "*"}})