API stopped allowing CORS requests

Question

I'm currently using the API via JavaScript AJAX calls and it all of a sudden stopped allowing CORS requests. I'm on localhost and I tried uploading my code to live and am still getting:

Access to XMLHttpRequest at 
'https://api.stackexchange.com/2.2/search/advanced?pagesize=100&order=desc&sort=relevance&q=unit%20testing%20in%20react&answers=1&wiki=False&site=stackoverflow&key=g1ojUOeEFrEJKWLcC5yqhQ(('
from origin 'http://localhost:3000' has been blocked by CORS policy:
No 'Access-Control-Allow-Origin' header is present on the requested
resource.
Cross-Origin Read Blocking (CORB) blocked cross-origin response
https://api.stackexchange.com/2.2/search/advanced?pagesize=100&order=desc&sort=relevance&q=unit%20testing%20in%20react&answers=1&wiki=False&site=stackoverflow&key=g1ojUOeEFrEJKWLcC5yqhQ((
with MIME type application/json. See
https://www.chromestatus.com/feature/5629709824032768 for more
details.

I see it has happened previously -

The API has stopped allowing CORS requests

API endpoints do not set Access-Control-Allow-Origin, so CORS requests fail

If I switch out my AJAX URL for something like api.github.com/users/:username then I get a response.

Response header from api.stackexchange.com:

Cache-Control: private
Content-Encoding: gzip
Content-Length: 15320
Content-Type: application/json; charset=utf-8
Date: Thu, 14 Nov 2019 16:55:55 GMT
X-Content-Type-Options: nosniff

vs Response header from api.github.com:

Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type
Cache-Control: public, max-age=60, s-maxage=60
Content-Encoding: gzip
Content-Security-Policy: default-src 'none'
Content-Type: application/json; charset=utf-8
Date: Thu, 14 Nov 2019 17:00:14 GMT
ETag: W/"01de5042f68702ea001f227ac84a26e5"
Last-Modified: Sun, 27 Oct 2019 07:40:00 GMT
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: GitHub.com
Status: 304 Not Modified
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Vary: Accept
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-GitHub-Media-Type: github.v3
X-GitHub-Request-Id: EA28:258A2:16B35E8:1B423C5:5DCD881D
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 60
X-RateLimit-Reset: 1573754414
X-XSS-Protection: 1; mode=block

Answer 1

The bug has been fixed:

Thanks for reporting. We're working on porting our websites to ASP.NET Core, and those errors you've seen were a result of this.

We caught the first error ourselves on a canary build and fixed it since it surfaced in the logs before deploying a full build. That full build contained the 2nd bug (no CORS headers), which we didn't see in our logs, but fixed quickly after seeing a bug report on MSE.

This bug was introduced to the ASP.NET MVC (old framework) code when we were porting (cross-targeting) the common API code to ASP.NET Core. As a twist of fate, the new (ASP.NET Core) code actually is unit-tested and checks verifies the presence of the CORS headers. But, unfortunately, it doesn't power api.stackexchange.com yet (which still runs on ASP.NET Core), only our mobile app's API backend.

m0sa♦ on Meta Stack Overflow.