Recently, I noticed my browser console is flooded with error messages like below.
Access to XMLHttpRequest at 'https://api.appcues.net/v1/accounts/45873/users/xxxxxxxxxxxxxx/taco?url=https%3A%2F%2Fxxxxxxxxxxxxxxxxxxxx' from origin 'https://sssssssssssssss' has been blocked by CORS policy: Request header field request-id is not allowed by Access-Control-Allow-Headers in preflight response.
I think it might be caused by the AppInsights libraries we added to our project recently.
I wonder if there's a way to remove the request-id header for OPTIONS request.
One possible solution is that you can write a custom middleware, then in the middleware, you can try to remove the request-id header for OPTIONS request.
But I'm not sure if it would have some bad impacts when removing the header. So if it's possible, you'd better adding the header in the cors rule.