title: CORS preflight from https site to http localhost
body: <p>I'm using Brave right now (but I could reproduce the issue in Chrome as well.)</p>
  <p>Scenario:
  I have a control panel which served via Cloudflare on https. This should make a call to a service running locally http://localhost:39031. The local server served by go-chi and using it's CORS middleware. When the local server get's the response it returns 200 back to the control panel for the Preflight request.</p>
  <pre><code>2022-08-25T14:59:30+02:00 [DEBUG]  Handler: Preflight request%!(EXTRA []interface {}=[])
  2022-08-25T14:59:30+02:00 [DEBUG]  Preflight response headers: [map[Access-Control-Allow-Credentials:[true] Access-Control-Allow-Methods:[GET] Access-Control-Allow-Origin:[*] Access-Control-Max-Age:[300] Vary:[Origin Access-Control-Request-Method Access-Control-Request-Headers]]]
  2022/08/25 14:59:30 &quot;OPTIONS http://localhost:39031/hc HTTP/1.1&quot; from 127.0.0.1:43378 - 200 0B in 132.937µs
  </code></pre>
  <p>So it should be fine, but I get a message like this in the browser (which is a warning):</p>
  <pre><code>A cross-origin resource sharing (CORS) request was blocked because the response to the associated preflight request failed, had an unsuccessful HTTP status code, and/or was a redirect.
  To fix this issue, ensure all CORS preflight OPTIONS requests are answered with a successful HTTP status code (2xx) and do not redirect.
  </code></pre>
  <p>What make no sense, that it's doing the GET request otherwise, and I'm getting back the result properly. Does it maybe because the disabled shield?</p>
  <p>I don't see what I did which results this behavior. I also sent OPTIONS via Postman and it turns out that the response satisfy the needs of a preflight response. I already read nearly everything from Preflight response and handling.</p>
  <p>This is the Preflight Request:</p>
  <pre><code>Accept: */*
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
  Access-Control-Request-Method: GET
  Access-Control-Request-Private-Network: true
  Connection: keep-alive
  Host: localhost:39031
  Origin: https://sandbox.XXX.com
  Sec-Fetch-Dest: empty
  Sec-Fetch-Mode: cors
  Sec-Fetch-Site: cross-site
  User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36
  </code></pre>