We are using Cloudflare Access and really it. We discovered a bug before and briefly wanted to share with you that we probably have identified another issue around CORS for Cloudflare Access:
No matter what we do, we can’t get CORS to work for a naked domain with CNAME flattening. I’m not sure if this is relevant but wanted to mention it in case it turns out to be.
We recently moved from www to the naked domain and have previously used Cloudflare Access successfully with CORS. Unfortunately, the same configuration doesn’t work on the naked domain.