Access-Control-Allow-Origin works only for group 200 codes

[pinkynrg]

The documentation says:

Alternatively you can set CORS headers in a Grape before block.

before do header['Access-Control-Allow-Origin'] = '' header['Access-Control-Request-Method'] = '' end

Doesn't this work only for 200 http codes? What about all 400 codes? If this is correct, shouldn't be added in the documentations?

[dblock]

Probably. With specs.