V
V
Vitaly2021-02-16 17:16:13
CORS
Vitaly, 2021-02-16 17:16:13

How to properly enable CORS node express?

All the best!
What an incomprehensible problem I have with CORS, with a PUT or POST request, with GET - everything is fine.

On express server

app.put(`/requestRoute/`, async (req, res) => {
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Redirect");
    res.header("Access-Control-Allow-Methods", "PUT, POST, GET, DELETE, OPTIONS");
    res.header("Access-Control-Allow-Credentials", true);
    res.set('Access-Control-Allow-Origin', '*');
    res.set('Access-Control-Allow-Headers', 'Content-Type')


on the client

fetch('https://myserver/requestRoute/',{
        method: 'PUT',
        credentials: 'include',
        headers: {
            'Content-Type': 'application/json',
            'Accept': 'application/json',
            'Access-Control-Allow-Credentials': 'true'

        },
        body: JSON.stringify({ "someKey": "someVal" })
    })


Even in NGINX, which proxies all this stuff, added

add_header                     "Access-Control-Allow-Origin" "*";
    add_header                     "Access-Control-Allow-Headers" "Origin, X-Requested-With, Content-Type, Accept,Authorization";
    add_header                     "Access-Control-Request-Methods" "GET, POST, OPTIONS, PUT";


As a result, routes with GET pass, but they do not work with PUT / POST.
I don't understand anything anymore

...has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question