Flask-CORS not working for POST, but working for GET

In my case, a CORS error raised because of an internal error. An error completely unrelated to CORS, which should return 500, was causing this.

You have to add CORS(app, resources={r"/*": {"origins": "*"}}) into your flask app.

Hope that solves the issue.

the Flask-Cors docs explain why this might happen

"When using JSON cross origin, browsers will issue a pre-flight OPTIONS request for POST requests. In order for browsers to allow POST requests with a JSON content type, you must allow the Content-Type header. The simplest way to do this is to simply set the CORS_HEADERS configuration value on your application: e.g."

https://flask-cors.readthedocs.io/en/1.9.0/

app.config['CORS_HEADERS'] = 'Content-Type' 

In Post request browser send an OPTIONS request as a pre-flight request before it excutes post so enabling the OPTIONS request on your server with proper CORS headers will resolve this issue.

The CORS (Cross-Origin Resource Sharing) error occurs when a web application running in a browser tries to make a request to a different domain (origin) than the one it was loaded from. CORS is a security mechanism implemented in web browsers to prevent cross-origin requests by default, for security reasons. The basic logic behind the CORS error is as follows:

1. When a web application running in a browser makes a request to a different domain, the browser automatically sends an HTTP request called a "preflight" request to check if the cross-origin request is allowed. The pre-flight request is of OPTIONS type.

2. The server receiving the preflight request must respond with appropriate CORS headers indicating that the cross-origin request is allowed.

3. If the server does not respond with the necessary CORS headers or responds with incorrect headers, the browser blocks the actual request and throws a CORS error.

The CORS headers that the server should include in its response are:

1. Access-Control-Allow-Origin: Specifies the allowed origin(s) for the cross- origin request. It can be a specific domain or '*' to allow requests from any origin.

2. Access-Control-Allow-Methods: Specifies the allowed HTTP methods for the cross-origin request, such as GET, POST, PUT, DELETE, etc.

3. Access-Control-Allow-Headers: Specifies the allowed headers for the cross- origin request, such as Content-Type, Authorization, etc.

4. Access-Control-Allow-Credentials: Optional header that indicates whether the browser should include credentials (e.g., cookies, HTTP authentication) in the cross-origin request.

I was using the azure function httpTrigger to run the http post request in my flask application. So allowing options request in function.json file resolves the issue for me.

"methods": ["get","post","options"]