[Solved] CORS preflight return Access-Control-Allow-Origin but response hangs on

by


Both the preflight and actual response must grant permission with Access-Control-Allow-Origin.

If only the prelight does, then the order of events is:

  1. JavaScript asks to make request
  2. Browser makes preflight request
  3. Server sends preflight response
  4. Browser checks CORS (passes)
  5. Browser makes actual request
  6. Server sends actual response
  7. Browser checks CORS (fails)
  8. Browser denies permission to read the response to JS

solved CORS preflight return Access-Control-Allow-Origin but response hangs on