How to decide, "pre-validation is invalid (redirection)" or "redirection is not allowed for pre-verification"

Question

I followed this step to configure my server to enable CORS. https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api

But now in my dev console browser, I see this error message:

XMLHttpRequest cannot load https: // serveraddress / abc . Answer for preflight is invalid (redirect)

Do you know what I can do to fix this? I am making a CORS request in HTTPS. I think this leads to the failure of the "pre-flight failure" (forwarding). But I do not know why or what redirects the OPTIONS request.

Thanks.

Answer 1

Your code forces your browser to send a preliminary CORS OPTIONS request , and the servers respond with a 3xx redirect. Instead, he should respond with a 2xx success message.

You can change your code so that the browser does not send an OPTIONS request.

As for everything that happens in this case, it’s important to know that browsers do a preliminary CORS check if:

• request method is anything but GET , HEAD or POST
• You have set custom request headers other than Accept , Accept-Language , Content-Language , Content-Type , DPR , Downlink , Save-Data , Viewport-Width or Width
• Content-Type request header has a value other than application/x-www-form-urlencoded , multipart/form-data or text/plain

If you cannot change your code so that browsers do not perform a preliminary check, then there is another option:

1. Examine the URL in the Location response header in response to an OPTIONS request.
2. Modify your code to request this other URL instead.

The difference between the URLs can be as simple as the trailing slash in the path — for example, you might need to change the URL in the code to http://localhost/api/auth/login/ (note the trailing slash) instead http://localhost/api/auth/login (without a slash).

You can use the Network panel in devtools to check the response to an OPTIONS request and find the redirect URL in the header value of the Location response.

Answer 2

this sometimes happens when you try to call the https service as http

 for example when u perform a request on 'http://example.com/api/v2/tickets' which should be 'https://example.com/api/v2/tickets'