Comment 4 for bug 1868413

https://enable-cors.org/server_apache.html

^ This doesn't give you the solution, but where you should look. Ideally, the CORS settings are not in .htaccess (for performance reasons), but it should be in one of those places.