尽管存在 Access-Control-Allow-Origin header，但 Chrome 中的 CORS 问题

Question

A developer added new DELETE blog endpoint, whose source code is based on the existing and working DELETE page endpoint. It works on his PC but it fails on my PC. The Chrome does not run the DELETE method because of allegedly missing CORS header.

The attached picture shows Chrome dev tools screenshots for three different OPTION + DELETE/POST requests. I have checked that OPTIONS is always run for DELETE page request and it returns a CORS header for localhost. The response is the same as for POST a picture or DELETE a page. I cannot see any difference and I cannot find an explanation.

Backend is written in NodeJS

This code works on my PC: https://github.com/literakl/mezinamiridici/blob/master/backend/src/handlers/pages/deletePage.js

module.exports = (app) => {
  app.options('/v1/pages/:pageId', auth.cors);
  app.delete('/v1/pages/:pageId', auth.required, auth.cms_admin, auth.cors, async (req, res) => {

This code works on developer's Chrome and Firefox but fails on my Chrome or Edge https://github.com/literakl/mezinamiridici/blob/master/backend/src/handlers/items/deleteBlog.js

module.exports = (app) => {
  app.options('/v1/blog/:blogId', auth.cors);    
  app.delete('/v1/blog/:blogId', auth.required, auth.cors, async (req, res) => {

Frontend is written in Vue. The page with Delete button is loaded from http://localhost:8080/p/leos/b/wing-suit-2. OPTIONS returns:

Access-Control-Allow-Headers: Content-Type,Authorization
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: http://localhost:8080

Blocked DELETE request contains these request headers:

Origin: http://localhost:8080
Referer: http://localhost:8080/

So I assume that everything is set up correctly. Where is the issue please?

Update 1:

console log:

Access to XMLHttpRequest at 'http://localhost:3000/v1/blog/1f3j20k5qh' from origin 'http://localhost:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Answer 1

One thing I see is that the value in the header is different in the options call than in your delete call, specifically its less restrictive, might be that browsers take issue with that