Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

12
  • Could you provide some sample code (javascript) please? Also: CORS headers like Acces Control Allow Origin and Access Control Allow Methods are meant to be implemented serverside, and not to be included in the Request headers of your AJAX. Commented Mar 28, 2018 at 12:26
  • 1
    Did you add the 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'GET, POST, PUT', in the backend on the server side? Commented Mar 28, 2018 at 12:27
  • 1
    Add the code used to that ajax request, without it, and only with the respond, it's difficult to guess what's going on. Commented Mar 28, 2018 at 12:27
  • 2
    headers: { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'OPTIONS, HEAD, GET, POST, PUT, DELETE' }, putting this in your request makes no sense. Only the server can set these options. They belong in the response, not the request. Check the MDN documentation for these headers, it mentions they are server-only headers. Only the server gets to decide what methods it accepts, and what origins it allows CORS for. You, as the caller, can't decide that - or else what would be the purpose of CORS at all? Commented Mar 28, 2018 at 12:32
  • 1
    Start by removing headers: { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'OPTIONS, HEAD, GET, POST, PUT, DELETE' }, which will create preflights that are not working with AUTH Commented Mar 28, 2018 at 12:39