ActionHero v19+ CORS middleware

cors.js

const { Initializer, api } = require('actionhero');

// Adjust to suit... Or optionally move into config...
const allowedOrigins = [
    'https://staging.mydomain.com',
    'https://www.mydomain.com',
    'https://mydomain.com',
    'http://localhost:8080',
];

const fallbackOrigin = 'https://www.mydomain.com';

const setHeaders = (connection, origin) => {
    const { responseHeaders } = connection.rawConnection;
    const setOrigin = allowedOrigins.indexOf(origin) !== -1 ? origin : fallbackOrigin;

    responseHeaders.push(['Access-Control-Allow-Methods', 'HEAD, GET, POST, PUT, DELETE, OPTIONS']);
    responseHeaders.push(['Access-Control-Allow-Origin', setOrigin]);
};

const processCORS = data => {
    const { action, connection } = data;

    if (action === 'getSystemStatus') {
        return;
    }

    const rawConnection = connection.rawConnection || {};
    const headers = (rawConnection.req || {}).headers || {};

    setHeaders(connection, headers.origin);
};

module.exports = class CORS extends Initializer {
    constructor() {
        super();

        this.name = 'CORS';
        this.loadPriority = 1000;
        this.startPriority = 1000;
        this.stopPriority = 1000;
    }

    async start() {
        // Check incoming requests for authentication requirements
        // NOTE: Doesn't work because OPTIONS requests don't get processed through middleware. Left here as
        // documentation for that fact.
        api.actions.addMiddleware({
            name: 'Request Processing : CORS',
            global: true,
            priority: 50,
            preProcessor: processCORS,
        });

        const webServer = api.servers.servers.web;
        webServer.respondToOptions = connection => {
            const { origin } = connection.rawConnection.req.headers;

            setHeaders(connection, origin);
            webServer.sendMessage(connection, '');
        };
    }
};

I think your issue is there in your error. Don't access localhost:8080/api/endpoint. It needs to be http://localhost:8080/api/endpoint. CORS only applies with certain URI "schemes" so you need "http" at the front of it.

I tried that first and tried removing the protocol, still no luck.

Access to XMLHttpRequest at 'http://localhost:8080/api/endpoint' from origin 'http://localhost:3000' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'http://localhost:8080' that is not equal to the supplied origin.

I never got this working, but I also wanted to share this error I ran into incase anyone else does:
actionhero/actionhero#2032