rest.cors.allowed-origins = ${dspace.ui.url}
What gives? Check everywhere else the CORS might be set:
sh /dspace/bin/beginwildgoosechase.sh
grep -rl "cors.allowed" #find everywhere there is cors setting, etc.
Fast forward to a discovery that I can only upload files under 1mb.
It must be some issue with Tomcat, so I check /dspace/webapps/server/WEB-INF/classes/application.properties > spring.servlet.multipart.max-file-size = 512mb
Maybe it only accepts byte sizes? Restart tomcat... still doesn't work.
Wait! Tomcat is behind an Nginx proxy:
Add "client_max_body_size 200M;" to the server block of my site configuration.
FINALLY!