The issue is that railway-edge is intercepting the request before it hits your FastAPI code. Your allow_origins=["*"] doesn't matter .

What I think is happening:

Railway-edge often expects specific environment variables to trigger its CORS logic. If you are using a generic CORS_ORIGINS variable, the edge might only be parsing the first entry or failing on the comma.

Try these:

1. Swap the Order: Put the failing origin first in the CORS_ORIGINS string.
2. Check Railway UI: Go to Service Settings > Networking. If Railway has a built-in CORS section, add the origins there as separate entries rather than a single comma-separated string.

It’s unlikely a hyphen bug in 2026. It's more likely a string-length or parsing limit where the edge controller stops after the first valid URL it sees in that specific environment variable.

This is likely an issue with how your application is setup to handle CORS requests.

Take a look at these FastAPI docs on setting up CORS as a starting point: https://fastapi.tiangolo.com/tutorial/cors/

Railway doesn't actually do any CORS control on the edge that would cause this issue- so it probably has to do with how you're setting up CORS in Fast API 🙂

Specifically, make sure it's setup to handle OPTIONS requests- that seems to be where you're having problems?

Make sure your app has something like this set up before your routes:

import os
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

# pull out your custom origins
custom_origins = os.getenv("CORS_ORIGINS", "")
custom_origins_list = [o.strip() for o in custom_origins.split(",") if o.strip()]

origins = [
    "http://localhost",
    "http://localhost:8080",
    *custom_origins_list,
]

app.add_middleware(
    CORSMiddleware,
    allow_origins=origins,
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

The root cause was Railway's edge proxy intercepting OPTIONS preflights before FastAPI could handle them — confirmed via curl returning Server: railway-edge / Disallowed CORS origin 400s. FastAPI CORS middleware changes had no effect. The fix was a Vercel proxy architecture: browser → Vercel API routes → Railway (server-to-server, no CORS enforcement). The Railway Networking settings panel has no built-in CORS configuration UI. The CORS_ORIGINS env var parsing theory (Reply 1) could not be tested conclusively since the proxy resolved the immediate issue. Leaving open for Railway to investigate the asymmetric edge behavior.