The CORS Header Was Right There and the Browser Blocked It Anyway

Access-Control-Allow-Origin was visibly present in the response and the request still got blocked, because the browser's network tab was silently merging two duplicate headers into one line.