title: CORS in OAuth: Response to preflight request doesn't pass access control check
body: <p>So I'm trying to implement the OAuth 2 flow, while my webapp is the server that give away authorization code/access token.</p>
  
  <p>Cors error happens when sending the code back to third-party website(zapier in this case):</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="https://zapier.com/dashboard/auth/oauth/return/App505CLIAPI/?code=somecode&amp;state=somestate" rel="nofollow noreferrer">https://zapier.com/dashboard/auth/oauth/return/App505CLIAPI/?code=somecode&amp;state=somestate</a>. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="https://myurl" rel="nofollow noreferrer">https://myurl</a>' is therefore not allowed access.</p>
  </blockquote>
  
  <p>If I manually open a new tab, paste that zapier uri, everything works perfectly.</p>
  
  <p>Seems like a typical CORS issue, but none the popular solutions works for me:</p>
  
  <ol>
  <li>Add <code>Access-Control-Allow-Origin</code>: I'm using this <a href="https://github.com/jaredhanson/oauth2orize" rel="nofollow noreferrer">oauth2orize</a>
  library, and sending reponse to preflight seems also part of the
  library. So I cannot add header.</li>
  <li>Using <a href="https://www.npmjs.com/package/cors" rel="nofollow noreferrer">cors</a>: Have tried <code>app.use(cors())</code> and <code>app.options('*',
  cors())</code> which should apply to all routes, but simply not working.</li>
  </ol>
  
  <p>My webapp sits on a node express server, in front of which there's an nginx proxy server.</p>
  
  <p>Any idea where the problem might be is appreciated.</p>