Response Error 302

Question

I am making a GET request to my local web service, which I expect the 302 response to be returned with the location in the header. However, I get a response from undefined and a network error, although I can see locally that the request is being served and the response is generated without any errors in the web service.

I tried in Postman and Chrome and it gets a redirect response and redirects accordingly.

I'm not sure if this is a CORS problem, and if so, how can I solve this?

I already added a response header for the CORS filter

Access-Control-Expose-Headers: Location, [own headers] Access-Control-Allow-Origin: '*' Access-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE Access-Control-Max-Age: [some age] Access-Control-Allow-Headers: [own headers] 

And the location is present in the header when I use Postman

A request created using Axios and config,

 const config = { url: [someURL], method: 'GET', headers: { 'customHeader':'token', }, params: { [params] }, maxRedirects: 0, validateStatus: status => (status >= 200 && status < 300) || status === 302, }; 

Any help would really be appreciated as to why the answer is undefined when it reaches my JS code but works fine in Postman and Chrome.

How can I solve this is to use the HTTP 200 status code and redirect the location header, but I want to avoid this because it is technically a redirect response.

Answer 1

Part of your request to 'customHeader':'token' launches your browser to first send an OPTIONS request before a CORS request . Any headers that you add to a request other than headers defined as CORS-safelisted request-headers cause browsers to send an OPF request before sending. p>

The reason you don't get this from Postman is because unlike browsers, Postman does not implement CORS, so it does not send an OPTIONS request. (The postman does not work within the framework of the Web security model of the same origin that browsers use for web applications.)

If the server does not respond correctly in CORS preflight OPTIONS requests, your request will fail, and the only workaround is not to add this part of 'customHeader':'token' to your request or to somehow create your request in any way, which launches your browser request to do a CORS preview.