I have followed this step to setup my server to enable CORS. https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api
But now in my browser dev console, I see this error message:
XMLHttpRequest cannot load https://serveraddress/abc. Response for preflight is invalid (redirect)
Do you know what can I do to fix it? I am making a CORS request in HTTPS. I think that is causing the 'preflight is invalid (redirect)' failure. But I don't know why or what is redirecting the OPTIONS request.
Thank you.
Short answer: Make sure the request URL in your code isn’t missing a trailing slash.
That missing-a-trailing slash problem is the most-common cause of the error cited in the question.
However, that’s not the only cause — it’s just the most common one. Read on for more details.
Longer answer:When you see this error, it means your code is triggering your browser to send a CORS preflight OPTIONS
request, and the server’s responding with a 3xx
redirect. To avoid the error, your request needs to get a 2xx
success response instead.
You may be able to adjust your code to avoid triggering the browser to send the OPTIONS
request.
As far as what all’s going on in this case, it’s important to know browsers do a CORS preflight if:
GET
, HEAD
, or POST
Accept
, Accept-Language
, Content-Language
, Content-Type
, DPR
, Downlink
, Save-Data
, Viewport-Width
, or Width
Content-Type
request header has a value other than application/x-www-form-urlencoded
, multipart/form-data
, or text/plain
If you can’t change your code to avoid need for browsers to do a preflight, then another option is:
Location
response header in the response to the OPTIONS
request.The difference between the URLs might be something as simple as a trailing slash in the path — for example, you may need to change the URL in your code to http://localhost/api/auth/login/
(notice the trailing slash) rather than http://localhost/api/auth/login
(no trailing slash).
You can use the Network pane in browser devtools to examine the response to the OPTIONS
request and to find the redirect URL in the value of the Location
response header.