301 redirects and CORS issues

I'm getting the following error making request :(

I'm following guidelines set in the fetch api spec... any clue how to get around this?

XMLHttpRequest cannot load http://localhost:3000/auth/facebook?code={thecode} Redirect from 'http://localhost:3000/auth/facebook?code=[thecode]' to 'http://localhost:3000/omniauth/facebook?code=A[thecode]&resource_class=User' has been blocked by CORS policy: Request requires preflight, which is disallowed to follow cross-origin redirect.

# config/initializers/cors.rb
Rails.application.config.middleware.insert_before ActionDispatch::Static, Rack::Cors do
  allow do
    origins '*'

    resource '*',
      headers: :any,
      resource: '*',
      expose:  ['access-token', 'expiry', 'token-type', 'uid', 'client'],
      methods: [:get, :post, :put, :patch, :delete, :options, :head]
  end
end

Start with config/initializers/cors.rb and trace the request from /auth/facebook to /omniauth/facebook, including the 301 redirect and its query parameters. Reproduce the XMLHttpRequest failure locally and determine whether the redirect and CORS behavior can be made compatible; done means the request no longer fails with the reported cross-origin redirect error.