Development version of UI cannot access the API running at localhost

[nuest]

I'd like to run the UI locally, outside of a container, so I can properly debug it. When I run npm start locally, the React development server starts. Then I open http://localhost:3000/ and get errors about Cross-Origin requests:

However, when running requests agains the API with curl, the headers are there and AFAICT complete.

daniel@nuest ~/git/o2r/o2r-UI/ui [master]$ curl -H "Origin: http://localhost:3000" -D - -o /dev/null http://localhost/api/
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Tue, 06 Oct 2020 15:28:01 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 133
Connection: keep-alive
X-Powered-By: Express
ETag: W/"85-OuxkWZsG9k25cfYm9ZYrKtTqTls"
Set-Cookie: connect.sid=s%3Ay_GSQLRzSzZwf1J3HSbcTYLCwuzCm2qr.clD29EyEGLpupvbxVxYwc4NraoprQGJEEOP7NmS3XaQ; Path=/; HttpOnly
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

100   133  100   133    0     0  44333      0 --:--:-- --:--:-- --:--:-- 44333
daniel@nuest ~/git/o2r/o2r-UI/ui [master]$ curl -D - -o /dev/null http://localhost/api/
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0HTTP/1.1 200 OK
Server: nginx/1.17.7
Date: Tue, 06 Oct 2020 15:28:23 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 155
Connection: keep-alive
X-Powered-By: Express
ETag: W/"9b-db/k/jLjRkVVRKz18Qs1X4WBb4M"
Set-Cookie: connect.sid=s%3AA14KDFOh87_9CEDYmYQf4NQADmGgrAFJ.YUbswYN8c5ieJRZ%2F8RYhDvp4rzAvE0nwSx%2F%2BH%2BijoXI; Path=/; HttpOnly
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

100   155  100   155    0     0  51666      0 --:--:-- --:--:-- --:--:-- 51666

Maybe the React client must send the Origin header?