Can you please test with /actions/make-active instead of /forest/actions/make-active in your route definition? I am thinking that the forest subpath is already defined in an upper scope.
After trying what you suggested, I encountered the following error in the chrome dev console:
Access to fetch at 'http://localhost:3000/forest/actions/make-active' from origin 'https://app.forestadmin.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.
Which is weird because I have the following cors config, app.use("^(?!forest/?$).*", cors());, and all other requests coming from the frontend are running smoothly.
When setting the route path to /forest/actions/make-active, I get the following error:
Access to fetch at 'http://localhost:3000/forest/actions/make-active' from origin 'https://app.forestadmin.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
Which suggests the enabling of app.options('/forest/actions/make-active', cors()) , but get the same result. (Taken from the cors package docs)