Although the OPTIONS returns * for Allow-Headers I'm getting the following CORS response.

Access to XMLHttpRequest at 'https://example1.com' from origin 'https://example2.net' has been blocked by CORS policy: Request header field x-requested-with is not allowed by Access-Control-Allow-Headers in preflight response.

While the OPTION request looks like this:

Request Method: OPTIONS
Status Code: 204 

Request headers:

Access-Control-Request-Headers: x-requested-with
Access-Control-Request-Method: POST
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

Response headers:

access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-max-age: 86400
content-length: 0
content-type: text/plain charset=UTF-8
date: Wed, 12 Jun 2019 05:03:06 GMT
status: 204

Why do I get this CORS error? and how to avoid it?

  • Hello Roee and welcome to Security.SE. Please edit your question to include what you are actually trying to accomplish. Your question right now is a status, not an answerable question. – MechMK1 Jun 12 '19 at 8:48

The Access-Control-Allow-Headers header does not support wildcards. You can only supply a list of actual headers that are allowed.

If you still want to allow all headers, you can make your web application look at which headers are present in the request and reflect all these in Access-Control-Allow-Headers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.