CORS error despite http.cors_allowed_origins set

Configuration
1

I created a webhook trigger according to these instructions and am trying to send a POST request from my React application with JSON data I’ll then use in the automation. I’m getting this error:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://hooks.nabu.casa/xxx. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).

This is after adding the following to my configuration.yaml:

http:
  cors_allowed_origins:
    - http://localhost:3000

I understand that the issue here is the preflight OPTIONS request my browser sends, as I’m using the Fetch API - I can successfully trigger the automation using Postman, which doesn’t send the preflight request. Has anyone figured out a way to work around this?

2

Hacky workaround: I set the Content-Type to “text/plain”, which on HA’s end returned a MultiDict object in which the key was the entirety of the JSON and the value was an empty string. Then I templated away everything but the key: (trigger.data | string)[12:-7] | from_json