delete cors in production.rb

config/environments/production.rb

@@ -94,10 +94,4 @@
   # ]
   # Skip DNS rebinding protection for the default health check endpoint.
   # config.host_authorization = { exclude: ->(request) { request.path == "/up" } }
-
-  # allow all hosts
-  config.hosts.clear
-
-  # ensure CORS middleware is enabled in production
-  config.middleware.use Rack::Cors
 end