Method PUT is not allowed by Access-Control-Allow-Methods in preflight response

The preflight answered, but its Access-Control-Allow-Methods doesn't list the method you're using (often PUT, PATCH or DELETE). GET, HEAD and POST are always allowed.

Fix

Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE

This header must be on the OPTIONS response. * works only for requests without credentials. Also check that your router has an OPTIONS handler for that path: some frameworks return 405 for unhandled OPTIONS, which fails with a different error.

Want every stack fixed at once? The CORS Fix Kit ($9) includes the cors-doctor CLI plus tested configs for 13 stacks.

Reference

MDN: Cross-Origin Resource Sharing

Independent pages, not affiliated with or endorsed by any vendor mentioned.