title: Localhost and CORS with Auth0 not allowing me to login
body: <p>I'm making a React app and trying to use Auth0 to authenticate. After trying to log in, it returns this:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="https://my-domain.auth0.com/usernamepassword/login" rel="nofollow noreferrer">https://my-domain.auth0.com/usernamepassword/login</a>. Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. Origin '<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.</p>
  </blockquote>
  
  <p>I thought it would be related to this: <a href="https://stackoverflow.com/questions/34495297/cors-problems-with-auth0-and-react">CORS problems with Auth0 and React</a> but I have both <code>http://localhost:3000, http://localhost:3000/login</code> in the 'Allowed Origins (CORS)' spot in Auth0's settings (and yes I'm using the correct client ID as well).</p>
  
  <p>I tried putting <code>http://localhost:3000/, http://localhost:3000/login</code> in the 'Allowed Callback URL's (don't know exactly what that does) but that didn't work either.</p>
  
  <p>When I use the social connection (Google) it allowed me to login after putting <code>http://localhost:3000/login</code> in the Allowed Callback URL's.</p>
  
  <p>But it still won't work for just a new user logging in.</p>
  
  <p>Any help?</p>
  
  <p>If it makes a difference:</p>
  
  <ul>
  <li><p>Auth0 Logs show for the social login but there are no logs at all for when I connect otherwise</p></li>
  <li><p>I think related to this is that I also get this every time I load the page:</p>
  
  <blockquote>
    <p>There was an error fetching the SSO data. This could simply mean that there was a problem with the network. But, if a "Origin" error has been logged before this warning, please add "<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>" to the "Allowed Origins (CORS)" list in the Auth0 dashboard: ...(link to my dash)</p>
  </blockquote></li>
  <li><p>I get a 404 from the gravatar website</p></li>
  <li><p>Also I get these errors (may not be related):</p></li>
  </ul>
  
  <p><code>Refused to set unsafe header "accept-encoding"</code></p>
  
  <p><code>Refused to set unsafe header "user-agent"</code></p>