My server has code like this:

const express = require("express");
const app = express();
app.use(function(req, res, next) {
    res.setHeader("Access-Control-Allow-Origin", "https://client.github.io");
    res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
    res.setHeader("Access-Control-Allow-Credentials", true);
    next();
});
const gameServer = new Server({
    server: createServer(app),
    express: app
});
// define room
const port = process.env.GAMEPORT || 5000;

My client connection code is something like:

const config = {gameServer : "wss://my-server.herokuapp.com:5000"};
client = new Colyseus.Client(config.gameServer);
// client creates room

But when I try to run this, the OPTIONS request gets blocked, with firefox console giving me the message that request is blocked, reading remote resource at https://my-server.herokuapp.com:5000/matchmake/create/gameRoom. (Reason: CORS request did not succeed). On Chrome and Firefox, I don't even get the response headers of what is allowed, though.

I find this weird because I was able to successfully make https requests from the client using axios to the same server (had to not specify port though).

Any help or pointers to resources would be much appreciated!

You shouldn't need to manually set the "Access-Control" headers, since colyseus already does it for you: https://github.com/colyseus/colyseus/blob/master/src/Server.ts#L139-L150