title: CORS Issue after latest Chrome 85 Update
body: <p>I am a very new user here so, apologies in advance if I break any rule. Here is the problem I am facing and need suggestions please.</p>
  <p>I have a Chrome extension which works with Gmail &amp; consumes APIs from my web server running on nginx through Phusion Passenger server of Rails application.</p>
  <p>My Nginx version is nginx version: nginx/1.15.8 and Phusion Passenger version is Phusion Passenger Enterprise 6.0.1</p>
  <p>I had the CORS settings in nginx as follows:</p>
  <pre><code>####### CORS Management ##########
  
  add_header 'Access-Control-Allow-Origin' 'https://mail.google.com,https://*.gmail.com';
  
  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE, HEAD';
  
  add_header Referrer-Policy &quot;no-referrer&quot;;
  
  add_header Pragma &quot;no-cache&quot;;
  
  ##################################
  
  </code></pre>
  <p>This used to work until Chrome 84, however, with the latest update of Chrome 85, it has started throwing CORS errors as follows:</p>
  <p>########## Error started appearing in Chrome 85 ############</p>
  <p>Access to fetch at 'https://my-site.com/' from origin 'https://mail.google.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.</p>
  <p>##########################################</p>
  <p>After this, I updated the CORS settings to wide open as per the suggestions/reference from various sources and blogs and now updated CORS setting looks like this:</p>
  UPDATED CORS Settings in Nginx
  <pre><code>
   location / {
  
       if ($request_method = 'OPTIONS') {
  
          add_header 'Access-Control-Allow-Origin' $http_origin always;
          add_header 'Access-Control-Allow-Credentials' 'true' always;
          add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
          
          #
          # Custom headers and headers various browsers *should* be OK with but aren't
          #
  
          add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type' always;
          
          #
          # Tell client that this pre-flight info is valid for 20 days
          #
  
          add_header 'Access-Control-Max-Age' 1728000;
          add_header 'Content-Type' 'text/plain charset=UTF-8' always;
          add_header 'Content-Length' 0 always;
  
          return 204;
       }
  
       if ($request_method = 'POST') {
  
          add_header 'Access-Control-Allow-Origin' $http_origin always;
          add_header 'Access-Control-Allow-Credentials' 'true' always;
          add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
          add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type' always;
  
       }
  
       if ($request_method = 'GET') {
  
          add_header 'Access-Control-Allow-Origin' $http_origin always;
          add_header 'Access-Control-Allow-Credentials' 'true' always;
          add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
          add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type' always;
  
       }
  
  }
  </code></pre>
  <p>############################################</p>
  <p>After updating this setting in Nginx, the CORS error has gone but now I am getting 401 Unauthorized error from server when the extension makes API call.</p>
  <p>I tried tweaking all the methods but couldn't fix it up. Is there something which I am missing or doing differently?</p>
  <p>Please help!</p>