Access to fetch has been blocked by CORS policy.

Question

Dear Microsoft Community,
I am developing a Blazor front end.
Although in preflight response, those headers are included:
"
access-control-allow-headers: Origin,Content-Type
access-control-allow-methods: GET,HEAD,OPTIONS,PATCH,PUT,POST,DELETE
access-control-allow-origin: *
allow: POST
cache-control: no-cache
content-length: 76
content-type: application/json; charset=utf-8
date: Mon, 15 Nov 2021 16:30:35 GMT
expires: -1
pragma: no-cache
"

Here is back end
End Point
" // POST /api/users/login
[Route("login")]
[HttpPost]
public async Task<IHttpActionResult> Login([FromBody]AuthInfo loginRequest)
{
var userDbEntry = await Database.DatabaseManager.Instance.GetUserAsync(loginRequest.user);
var Message = new Dictionary<string, string>();

        try
        {
            // Valid user
            if (userDbEntry.NickName == loginRequest.user)
            { 
                // Valid password
                if (userDbEntry.Password == loginRequest.password)
                {
                    // Authenticate the user
                    //authentication logic is here(hidden)


                    UserInfo userRecordInDatabase = await Database.DatabaseManager.Instance.GetUserAsync(userDbEntry.NickName);

Message.Add("hi","user")

                    return Json(Message);

                }
                else 
                {
                   //some logic
var unsuccessfulMessage = new Dictionary<string, string>();
        unsuccessfulMessage.Add("something","something");
                        return Json(unsuccessfulMessage);                     
                }
            }
            else
            {
                //some other logic 
            }
        }
        catch (Exception)
        {
            // catch exception here
        }
    }

//////
Global.asax.cs
namespace WebSite.Service
{
public class WebApiApplication : System.Web.HttpApplication
{
protected void Application_Start()
{
GlobalConfiguration.Configure(WebApiConfig.Register);
}
}
}

//////
WebApi.Config
namespace WebSite.Service
{
public static class WebApiConfig
{
public static void Register(HttpConfiguration config) {

     // Web API configuration and services
     config.MapHttpAttributeRoutes();
 }

}
}

"
I got 405 status code and this error in console:
"Access to fetch at '[URL]' from origin 'http://localhost:2580' has been blocked by CORS policy:
Response to preflight request doesn't pass access control check: It does not have HTTP ok status."
From the above it becomes clear that the server allows cross-origin requests and methods, but still my request is blocked
Would you assist me!
Best Regards!

Answer 1

Given your updated code., I believe the client call to "https://myAPI/login" does not match the actual API URL. Use the same URL you are using in PostMan.

Answer 2

most likely the 405 CORS comes from the server throwing an error. the error page does not support CORS. be sure you are correctly logging error, and check your log.