Response to preflight request doesn't pass access control check

Before a non-simple request (JSON body, Authorization header, PUT/PATCH/DELETE), the browser sends an OPTIONS preflight. This error means that preflight failed. The rest of the message says why:

• "It does not have HTTP ok status": OPTIONS returned 401/403/404/405/500. Preflights never carry cookies or the Authorization header, so auth middleware rejects them.
• "No 'Access-Control-Allow-Origin' header is present": the OPTIONS response has no CORS headers.
• "Redirect is not allowed": see redirect on preflight.

Check

curl -si -X OPTIONS https://api.example.com/x \
  -H "Origin: https://app.example.com" \
  -H "Access-Control-Request-Method: PUT" \
  -H "Access-Control-Request-Headers: content-type,authorization"

Fix

Answer OPTIONS with 204 before authentication, CSRF and routing, with:

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 600
Vary: Origin

Want every stack fixed at once? The CORS Fix Kit ($9) includes the cors-doctor CLI plus tested configs for 13 stacks.

Reference

MDN: Cross-Origin Resource Sharing

Independent pages, not affiliated with or endorsed by any vendor mentioned.