Redirect is not allowed for a preflight request

The OPTIONS preflight got a 301, 302, 307 or 308. Browsers don't follow redirects on a preflight, so no CORS header will fix this. Change the URL instead.

Usual causes

• http:// redirecting to https://
• Trailing slash: /api/items to /api/items/ (Django APPEND_SLASH, FastAPI redirect_slashes, Next.js trailingSlash)
• Apex to www, or a login redirect on OPTIONS

Check

curl -si -X OPTIONS https://api.example.com/api/items \
  -H "Origin: https://app.example.com" \
  -H "Access-Control-Request-Method: POST" | head -1

Fix

If you see a 3xx, call the exact final URL from your front end: same scheme, host and trailing slash as the Location header. If it's a login redirect, exempt OPTIONS from auth.

Want every stack fixed at once? The CORS Fix Kit ($9) includes the cors-doctor CLI plus tested configs for 13 stacks.

Reference

MDN: Cross-Origin Resource Sharing

Independent pages, not affiliated with or endorsed by any vendor mentioned.