20

I am trying to make a PUT call to my rest api endpoint, and getting this error:

Method PUT is not allowed by Access-Control-Allow-Methods in preflight response.

I enabled CORS using this solution: enable-cors, it works for POST.

How do I achieve the same for PUT?

Thanks.

8
  • 1
    Did you read the error message? developer.mozilla.org/en-US/docs/Web/HTTP/…
    – SLaks
    Feb 26, 2017 at 0:57
  • 2
    you need to add PUT (and probably OPTIONS) to Access-Control-Allow-Methods header Feb 26, 2017 at 1:04
  • 1
    Thanks @SLaks and Jaromanda, I added PUT in my header: res.header("Access-Control-Allow-Methods", "PUT");. It worked. Feb 26, 2017 at 1:09
  • You will also have to support the OPTIONS method on your server because when a client users PUT, the browser will pre-flight the request with an OPTIONS request first and only if the browser gets the right result back will it allow the PUT.
    – jfriend00
    Feb 26, 2017 at 1:54
  • @jfriend00: No; OPTIONS is part of the protocol and doesn't need a separate entry in the header.
    – SLaks
    Feb 27, 2017 at 19:39

2 Answers 2

42

add this:

res.header('Access-Control-Allow-Methods', 'PUT, POST, GET, DELETE, OPTIONS');

app.use(function(req, res, next) {
       res.header("Access-Control-Allow-Origin", "*");
       res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
       res.header('Access-Control-Allow-Methods', 'PUT, POST, GET, DELETE, OPTIONS');
          next();
    });
1
  • Thanks for the this information. I was bit confused with my code. Now it got fixed. May 27, 2018 at 19:08
10

You will need to support the OPTIONS method on your server because the browser will pre-flight all cross-origin PUT requests, no matter what headers you have. And, you need to make sure you're explicitly allowing PUT in your CORS headers. See this from MDN's page on CORS:

Additionally, for HTTP request methods that can cause side-effects on server's data (in particular, for HTTP methods other than GET, or for POST usage with certain MIME types), the specification mandates that browsers "preflight" the request, soliciting supported methods from the server with an HTTP OPTIONS request method, and then, upon "approval" from the server, sending the actual request with the actual HTTP request method. Servers can also notify clients whether "credentials" (including Cookies and HTTP Authentication data) should be sent with requests.

So, in your server, you would need to do something like this:

app.use(function(req, res, next) {
    res.header('Access-Control-Allow-Origin', '*');
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,PATCH,OPTIONS');
    res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, Content-Length, X-Requested-With');
    // allow preflight
    if (req.method === 'OPTIONS') {
        res.send(200);
    } else {
        next();
    }
});

Here's an article on the topic:

Cross-Origin Requests in Express.JS

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.