In IIS configuration CORS can be disabled.

I think I'll have to solve the problem in the client. The react-native app opens the web app with something like <WebView source={{ uri: 'file:///android_asset/web/index.html }} /> I don't know how to solve this yet, but I'll try to change the client rather than the server. Why is a file URL not mapped to origin: localhost? I wouldn't have any problems than ;-)

As I understand, Access-Control-Allow-Origin in the header depends on origin in the request header. Origin in request header is null because the web app running on Android has a file:// URL. We're using IIS and I found some manual about how to enable CORS. So I assumed CORS can be disabled. But when I think about it now, it might be better to support CORS but allow all origins. FYI: The webserver is in a private network but there are many devices to access it. I hope I could clarify the situation, althought I don't understand CORS well. I'll edit the question, if this info helps.