CORSの設定が反映されているのかを確認する

$ bundle exec rails --version
Rails 6.0.4.6

$ curl localhost:3000 --head
HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Content-Type: text/html; charset=utf-8
ETag: W/"9b005ffa5c5afcde4622c7b65d9908d0"
Cache-Control: max-age=0, private, must-revalidate
Content-Security-Policy: script-src 'unsafe-inline'; style-src 'unsafe-inline'
X-Request-Id: b9e4dbbb-d5e0-4ae7-9a19-f989af3e995f
X-Runtime: 0.126126
Vary: Origin

gem 'rack-cors'

config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins 'sample.com'
    resource '/', headers: :any, methods: [:get, :options]
  end
end

$ curl -X GET -H "Access-Control-Request-Method: GET" -H "Origin: https://sample.com" --head http://localhost:3000

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://sample.com
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Expose-Headers:
Access-Control-Max-Age: 7200
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Content-Type: text/html; charset=utf-8
ETag: W/"9b005ffa5c5afcde4622c7b65d9908d0"
Cache-Control: max-age=0, private, must-revalidate
Content-Security-Policy: script-src 'unsafe-inline'; style-src 'unsafe-inline'
X-Request-Id: 61430f41-f2ac-4840-bfd2-47580f9702f3
X-Runtime: 0.010819
Vary: Origin
Transfer-Encoding: chunked