title: Firefox CORS failure with express node server
body: <p>I'm using Express.js with the CORS middleware. I'm getting very strange behavior on Firefox v73.0.1 (64-bit)</p>
  
  <p>Clean firefox profile... so nothing is cached.</p>
  
  <ol>
  <li>I try a direct request to <a href="http://localhost/search?q=AMZN" rel="noreferrer">http://localhost/search?q=AMZN</a>, I get results as expected.</li>
  <li>I open my webapp which is running on localhost:3000. All of these requests are not using TLS/SSL.</li>
  <li>I get "Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <a href="http://localhost/search?q=AMZN" rel="noreferrer">http://localhost/search?q=AMZN</a>. (Reason: CORS request did not succeed)." when it tries to reach out to the API server backend.</li>
  <li>I refresh the other tab where I was accessing localhost directly (same request which succeeded before), and I get a "connection reset". </li>
  </ol>
  
  <p>Chrome does not do this...</p>
  
  <p>I have been looking at wireshark and Firefox simply sends a GET request (several of them? Why?? I'm only making one), sends the headers and such, then it is followed by connection reset.</p>
  
  <p>Sounds like node is doing something wrong? Or I dunno.</p>
  
  <pre><code>const express = require('express');
  const fetch = require('node-fetch');
  const util = require('util');
  const app = express();
  const port = 80;
  
  var cors = require('cors')
  
  var copts = {
    origin: function (origin, callback) {
        console.log('yeah');
      // allow all
      callback(null, true);
    }
  }
  
  const SEARCH_URL = 'https://api.stocktwits.com/api/2/streams/symbol/%s.json';
  
  app.get('/search', cors(copts), (req, res) =&gt; {
  </code></pre>
  
  <p>The "yeah" part never is hit at all.</p>
  
  <p>Very simple clientside code.</p>
  
  <pre><code>return fetch(BACKEND_URL + uri).then(response =&gt; {
  </code></pre>
  
  <p>Tried removing CORS middleware and added these headers, based on examining github's cross-browser request-response in chrome</p>
  
  <pre><code>    res.header('Access-Control-Allow-Methods', 'GET');
      res.header('Access-Control-Max-Age', '3600');
      res.header('Vary', 'Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding');
      res.header('Access-Control-Allow-Origin', '*');
  </code></pre>
  
  <p>I didn't really have the options handler captured so maybe this didnt matter. I found those headers in the GET response.</p>