Update to Craft 4 causing CORS error on login to CP on live site only

Question

I have recently updated a website to Craft 4 and all went well, but now I cannot login to the Control Panel as I'm getting an error:

Access to XMLHttpRequest at 'https://www.xxx.com/index.php?p=cplogin%2Factions%2Fusers%2Flogin&v=1666866059344' from origin 'https://xxx.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

I have read various other posts and added in a combination of the following lines to the web/.htaccess file, but im really out of my depth with this error and don't really understand what to do as its not making any difference (i've added all lines in incase one of them is correct!):

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Send would-be 404 requests to Craft
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
    RewriteRule (.+) index.php?p=$1 [QSA,L]
    
    RewriteCond %{REQUEST_METHOD} OPTIONS
    RewriteRule ^(.*)$ $1 [R=200,L]
    
</IfModule>

<ifModule mod_headers.c>
    Header always set Access-Control-Allow-Headers "X-Requested-With, Authorization, Content-Type, Request-Method"
    Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
    
    SetEnvIf Origin "^http(s)?://(.+\.)?(xxx.com)(:[0-9]+)?$" origin_is=$0
    Header always set Access-Control-Allow-Origin %{origin_is}e env=origin_is
    
    SetEnvIf Origin ".*\S.*" ORIGIN=$0
    Header always set Access-Control-Allow-Origin %{ORIGIN}e env=ORIGIN
</ifModule>

Obviously all references to 'xxx.com' have been changed from the live domain.

Answer 1

It's likely the difference between www and non-www domains. The error suggests that your config is using www..com as your primary site URL, yet the error suggests that you've logged in at the non-www version:

... to XMLHttpRequest at 'https://www.xxx.com/ ...

... from origin 'https://xxx.com' ...

Does CP work from the www variant of the URL? If so, I'd just add some .htaccess directives to ensure that your site is always served from your preferred URL (i.e. with www, or without www).

Irrelevant aside: I really wouldn't be using xxx.com as example domains... I had an account manager once send an email to a client with that in it, meaning as a placeholder for something. Client clicked on the URL that the mail client decided was best to render, which didn't go down well...