title: CORS and same-origin policies request problems in a react bundled app
body: <p>Well, im trying to deploy an app bundled with <code>webpack</code> and <code>create-react-app</code>, the theory here is simple:</p>
  
  <p>Im using environment variables for some things, but in a nutshell in <code>development</code> we use an URL like <code>http://theapp.app.com/api/v3/endpoint</code>, and it works.</p>
  
  <p>In <code>production</code> mode (<code>yarn build</code>), the URL is <code>http://localhost/api/v3/endpoint</code>, there is the unique change.</p>
  
  <p>Anyway, i'm using the <code>fetch</code> API to make my requests, and i'm playing with the <code>mode</code> of the fetch config. For <code>development</code> it's <code>mode: 'cors'</code> because the server it's not in my local machine, and it works perfectly.</p>
  
  <p>In the case of <code>production</code> flag, i tried with <code>mode: 'same-origin'</code> and <code>cors</code> but i get this two errors in the respectively order:</p>
  
  <ul>
  <li><p>same-origin enabled in production
  <a href="https://i.stack.imgur.com/k2rGw.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/k2rGw.png" alt="enter image description here"></a></p></li>
  <li><p>cors enabled in production
  <a href="https://i.stack.imgur.com/JYSOl.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/JYSOl.png" alt="enter image description here"></a></p></li>
  </ul>
  
  <p>Some aclarations before:</p>
  
  <ol>
  <li>Yes, the API app and the bundle are served by the same server/machine.</li>
  <li><p>Yep, we have CORS configured on the server (we are using python bottle):</p>
  
  <p><code>@app.hook('after_request')
  def enable_cors():
      response.headers['Access-Control-Allow-Origin'] = '*'
      response.headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept'
      response.headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'</code></p></li>
  <li>Yes, i know that the request origin URL's are not equal in the <code>same-origin</code> policy, but with <code>cors</code> enabled it explodes too and the <code>http://data.blabla</code> is the url from the direct server....  i just don't know what to do.</li>
  </ol>
  
  <p>Any idea? I (sadly) have hours stucked in this.</p>