title: CLI CORS Proxy not changing origin, still get 403 on API reqs?
body: <p>Yes, I've found a ton of stuff similar but still not resolved for my instance. I would like to avoid killing the browser side security and instead let the proxy do its job but I fear I'm missing some inane detail in the setup and I'm no CORS expert by any means.</p>
  
  <p>So, what I get...a 403;</p>
  
  <pre><code>Failed to load http://localhost:10000/some/rest/endpoint: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:4200' is therefore not allowed access.
  </code></pre>
  
  <p>Wherein <code>localhost:10000</code> is my api url, and <code>:4200</code> is the default Angular CLI instance.</p>
  
  <p>So I config a proxy as I'd expect to as such in the angular.json;</p>
  
  <pre><code>"serve": {
            "builder": "@angular-devkit/build-angular:dev-server",
            "options": {
              "browserTarget": "angular-proj:build",
              "proxyConfig": "./proxy.conf.json"
            },
  </code></pre>
  
  <p>and add a proxy.conf.json;</p>
  
  <pre><code>{
      "/some/rest/*": {
        "target": "http://localhost:10000",
        "secure": false,
        "changeOrigin": true,
        "logLevel": "debug"
      }
    }
  </code></pre>
  
  <p>I serve it up and even flag the proxy.conf which the CLI serve confirms;</p>
  
  <p><code>[HPM] Proxy created: /some/rest  -&gt;  http://localhost:10000</code> etc...</p>
  
  <p>....except I still get the 403, and still see in the Request* headers;</p>
  
  <pre><code>Host: localhost:10000
  Origin: http://localhost:4200
  </code></pre>
  
  <p>So my question is, what inane detail am I missing here? I don't want to asterisk out the requests on all origins, and I don't want to shut off the browser checks, I would much prefer to have this nicely bundled up in the serve config like I'm doing so another pair of eyes are more than welcome. Cheers</p>
  
  <p><strong>ADDENDUM</strong>: My GET's seem to go through fine however something like a <code>Access-Control-Request-Method: POST</code>shows as <code>Request Method: OPTIONS</code> and that's where I get my 403...why would a POST become an OPTIONS??</p>
  
  <p><strong>ADDENDUM #2</strong>: Worth mentioning, I get this issue in Chrome / Firefox but everything is kosher in Edge???</p>
  
  <p><strong>ADDENDUM #3</strong>: This is running serve as <code>--aot=true</code> with proxy.</p>