I've got a really strange problem with Sharepoint Provider-hosted Add-in configuration, but only on production site.
I've got a frontend deployed to SiteAssets/home.js which is working fine, and the backend is on the Azure AppService.
On the site collection i've got the Application (_layouts/15/AppNewReg.aspx) created and the .app package from visual studio installed to global app catalog + added to the site.
When i'm calling the appService with ClientId from older deployment everything is working just fine, but when i generate a new ClientId, ClientSecret all i got from the appservice is a CORS ERROR.
I need to create exact configuration from scratch, and remove the previous, so i cannot just stick with the old "Frontend APP A"
+---------------------+----------------+----------------+
| | AppReg A | AppReg B |
+---------------------+----------------+----------------+
| AppService Code OLD | OK | CORS Error |
| AppService Code NEW | 500 Error | CORS Error |
+---------------------+----------------+----------------+
There is a also a CORS error in the console
Access to XMLHttpRequest at 'https://xxx.sharepoint.com/sites/intra/layouts/15/AppRedirect.aspx?client_id=8c6c8d0f-28f7-4dfa-9ac0-b6bacc8be503&redirect_uri=https%3A%2F%2Fxxx.azurewebsites.net%2FFeedback%2FGetCountOfActiveTicketsForCurrentUser%3F%7BStandardTokens%7D%26IntraClient%3Df9e4fd3b-713c-47e0-8443-6c11b7abde84%26%3D1607450676287%26SPHasRedirectedToSharePoint%3D1' (redirected from 'https://xxx.azurewebsites.net/Feedback/GetCountOfActiveTicketsForCurrentUser?IntraClient=f9e4fd3b-713c-47e0-8443-6c11b7abde84&SPHostUrl=https%3A%2F%2Fxxx.sharepoint.com%2Fsites%2Fintra&_=1607450676287') from origin 'https://xxx.azurewebsites.net' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. xxx.azurewebsites.net/Scripts/jquery-3.1.1.js:9536
