Update CORS headers again

[mattjohnsonpint]

Trying a different bit of advice, based on https://stackoverflow.com/a/76202037/634824 and https://www.moesif.com/blog/technical/cors/Authoritative-Guide-to-CORS-Cross-Origin-Resource-Sharing-for-REST-APIs/

Part of HYP-1155

[linear]

HYP-1155 CORS headers are being stripped away on production endpoint

Runtime v0.6.4 was updated to emit CORS headers to resolve this issue:

• HYP-1137

This works just fine locally, but on the production endpoint there still are no CORS headers. It appears that they are being stripped away somewhere in the infra layer.

Attached test.html file reproduces the issue. It has a production endpoint and auth token hardcoded in it. Save it somewhere and just open it in Chrome. It should make a simple query and display the result. Instead it errors. Use F12 to open Chrome's developer tools console, and you'll see the CORS error:

image.png

Again, the Runtime does indeed emit CORS headers, so this is not a Runtime issue but something in the infra.

test.html