Expected:

• Setup GraphQL endpoint with cors (default express setup)
• Setup GraphiQL (default setup)
• Allows querying

Actual:

• Throws Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin '<location>' is therefore not allowed access.

Cause: https://github.com/apollographql/apollo-server/blob/master/packages/apollo-server-module-graphiql/src/renderGraphiQL.ts#L147