CORS error with SPA + Rest API (Auth Code Flow)

[dan.woda]

This thread is continued here:

CORS pre-flight fails for new tenant / universal login

I am seeing this error in the browser running my SPA: Access to XMLHttpRequest at 'https://naboo.auth0.com/authorize?client_id=xxxxxxDNNEQS2NyxHxYxxxxx&redirect_uri=http%3A%2F%2Flocalhost%3A4004%2Fapi%2Fauth%2Fauth0%2Fcallback&response_type=code&scope=openid+profile+email' (redirected from 'http://localhost:4004/api/auth/auth0') from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Here is the pre-flig…