I am opening the UI directly from swagger-ui folder in golang, and hosting the yaml at localhost:8080/swagger/#

I think I have correctly enabled CORS, my curl output is as follows. For any API call, I see the preflight headers correctly defined with 200K, however I do see 403 error.

 $ curl -I "http://localhost:8080/swagger/#"

  HTTP/1.1 200 OK
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, DELETE
  Access-Control-Allow-Headers: Origin, Content-Type, X-Requested-With, accept
  Accept-Ranges: bytes

I tried to enable cors via middleware and every other solution available. The curl req is working fine locally. I have tried to disable security on web browser start chrome --disable-web-security --user-data-dir="C:\chrome_dev" for which it’s returning response correctly.

     package main

    import (
    "context"
    "configurations"
    "utils"
    "flag"
    "log"
    "net/http"
    "os"
    "os/signal"
    "time"
    "github.com/gorilla/mux"
    "github.com/rs/cors"
   )

func main() {

    configs := configurations.conf(utils.CONFIG_FILE)
  
r := mux.NewRouter().StrictSlash(true)
    
    createRoutes(r)

    cOpts := cors.Options{AllowedOrigins: []string{"*"},
    AllowedMethods:   []string{"GET", "POST","PUT","OPTIONS","DELETE"},
    AllowedHeaders:   []string{"accept", "Origin", "Content-Type", "X-Requested-With"},
    AllowCredentials: false,
}

    corsHandler := cors.New(cOpts)

    
    srv := &http.Server{
        Addr: configs.ThisPortNumber,
        Handler: corsHandler.Handler(r),
        
    }
    
    go func() {

        if err := srv.ListenAndServe(); err != nil {    
            log.Println(err)
       }

    }()

    c := make(chan os.Signal, 1)

    signal.Notify(c, os.Interrupt)


    <-c


    ctx, cancel := context.WithTimeout(context.Background(), wait)
    defer cancel()

    srv.Shutdown(ctx)

    configurations.PrintToLog(configurations.LogClassInformational, logRequestId, logFunctionFunctionName, "shutting down")
    os.Exit(0)

}