ruby on rails - Unauthorized CORS when using simple_command gem with rack-cors -

edit: had nothing cors, fell down red herring rabbit hole hard because response in dev tools looked this:

response = response {type: "cors", url: "http://localhost:3000/api/authenticate", redirected: false, status: 401, ok: false, …} 

the response had cors type , tunneled. because word cors there. looked @ response again, more closely (thanks sideshowbarker) , credentials not being passed in correctly because two-way binding broken. nothing see here.

i creating website rails backend , react client. have been using rack-cors gem deal cors , have following configuration in config/application.rb

config.middleware.insert_before 0, rack::cors     allow         origins '*'         resource '*', :headers => :any, :methods => [:get, :post, :options]     end end 

everything working great, until time work on simple authentication scheme. followed tutorial: https://www.pluralsight.com/guides/ruby-ruby-on-rails/token-based-authentication-with-ruby-on-rails-5-api (great tutorial btw). tutorial uses gem called simple_command create service objects handy things authentication. ended following authentication command:

#/commands/authenticate_user.rb class authenticateuser  prepend simplecommand       def initialize(username, password)          @username = username          @password = password      end       def call         jsonwebtoken.encode(user_id: user.id) if user      end       private      attr_accessor :username, :password       def user         user = user.find_by_username(username)          return user if user && user.authenticate(password)           errors.add :user_authentication, 'invalid credentials'          nil      end   end 

this gets called inside authentication controller here:

#/controllers/api/v1/authentication_controller.rb module api::v1     class authenticationcontroller < apicontroller          def authenticate             command = authenticateuser.call(params[:username], params[:password])             if command.success?                 render json: { auth_token: command.result }             else                  render json: { error: command.errors }, status: :unauthorized              end         end     end end 

i can call authenticate endpoint curl, or postman , works great. when call react client 401 cors unauthorized error. seem able authenticateuser#user , cors error thrown. there need add rack::cors config allow commands ignore cors? (every other endpoint, ones don't use commands, work fine client)