When attempting to access an Azure AD secured web API from a SharePoint framework web part, I get the following error:
Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '[my O365 SharePoint URL here]' is therefore not allowed access.
However, the request for the same API works fine from test-cors. When I look at the headers, the 'Access-Control-Allow-Origin' appears in the test-cors response, but it does not exist in the response returned from the SPFx web part call.
But this is the same API being called in both cases, how can that be?