Rack::Cors doesn't insert headers when Rails app errors out. Fix it by inserting Rack::Cors at the top of your middleware stack.

application.rb

config.middleware.insert 0, Rack::Cors do
  allow do
    origins(/^https:\/\/app.client.com$/)
    resource '*',
      headers: :any,
      methods: [:get, :put, :post, :delete]
  end
end

May solve your issues that look like this:

XMLHttpRequest cannot load https://api.server.com/. Origin https://app.client.com/ is not allowed by Access-Control-Allow-Origin.