Access-Control-Allow-Methods is response header

[bravequickcleverfibreyarn]

Description

From https://learn.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-8.0#preflight-requests

The preflight request uses the HTTP OPTIONS method. It may include the following headers:

• Access-Control-Request-Method: The HTTP method that will be used for the actual request.
• Access-Control-Request-Headers: A list of request headers that the app sets on the actual request. As stated earlier, this doesn't include headers that the browser sets, such as User-Agent.
• Access-Control-Allow-Methods

From https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods

The Access-Control-Allow-Methods response header specifies one or more methods allowed when accessing a resource in response to a preflight request.

Access-Control-Allow-Methods does not participate in any request including CORS preflight.

Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-8.0#ecors6

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/cors.md

Document ID

d3f332c4-4c60-039e-0e1e-bc6b11831f87

Article author

@tdykstra

---

Associated WorkItem - 317475

[tdykstra]

@bravequickcleverfibreyarn Thanks for reporting this.