If you use CORS, you need to add ‘Allow origin’ header to the response. But don’t forget: also any error responses need the ‘Allow Origin’ header. So even if you add the header to the response, if you have a Abort, also add this header to the abort response.
Sadly, you can’t directly. You must supply a new error handler taking over abort() based on error code and add the extra headers in the error handler. Not that hard, but still.
But there is another issue if you use flask restful. Flask Restful takes over flask error handling and you can’t supply your own headers to errors handled by Flask restful.
Best is to avoid abort() if you need to add specific headers to the abort response. Create your own exception instead and raise that exception which stops the current request. Handle your own exceptionclass in the flask errorhandler @app.errorhandler and add the extra headers there.
Besides POST, also take care of the headers during the additional OPTION request performed by browsers such as chrome.