Allow CORS: Access-Control-Allow-Origin not working

Question

Allow CORS: Access-Control-Allow-Origin not working

Joe Green 146

I have IIS 8.5 running on Win 2012 R2 server. I installed CORS module from here https://www.iis.net/downloads/microsoft/iis-cors-module. Created a web.config file with this

<?xml version="1.0" encoding="utf-8"?>
<configuration>
 <system.webServer>
    <cors enabled="true" failUnlistedOrigins="true">
        <add origin="*" />
    </cors>
   <httpProtocol>
     <customHeaders>
        <add name="Access-Control-Allow-Origin" value="*" />
     </customHeaders>
   </httpProtocol>
 </system.webServer>
</configuration>

In IIS Manager, under HTTP Response Headers, I added Access-Control-Allow-Origin with a value of *.

Still I'm getting the CORS error - Access to XMLHttpRequest at 'https://google.com' from origin 'http://mysite.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

What am I doing wrong?

Joe

Sam Wu-MSFT 7,561 Microsoft External Staff

@Joe Green Are you getting the same error without cors enabled? Maybe you can also try adding the following configuration to the web.config file to enable cors.

<system.webServer>  
    <httpProtocol>  
        <customHeaders>  
            <add name="Access-Control-Allow-Origin" value="*" />  
            <add name="Access-Control-Allow-Methods" value="GET,POST,OPTIONS" />  
            <add name="Access-Control-Allow-Headers" value="Content-Type, soapaction" />  
        </customHeaders>  
    </httpProtocol>  
</system.webServer>

1 answer

Your answer

Sam Wu-MSFT 7,561 Reputation points Microsoft External Staff

2022-01-07T01:29:00.96+00:00

@Joe Green Are you getting the same error without cors enabled? Maybe you can also try adding the following configuration to the web.config file to enable cors.

<system.webServer> <httpProtocol> <customHeaders> <add name="Access-Control-Allow-Origin" value="*" /> <add name="Access-Control-Allow-Methods" value="GET,POST,OPTIONS" /> <add name="Access-Control-Allow-Headers" value="Content-Type, soapaction" /> </customHeaders> </httpProtocol> </system.webServer>

Answer 1

Couch 1

@Sam Wu-MSFT The config you have posted does not work. Still the same same error. I have tried all in this document cors-module-configuration-reference

But still receiving the same same error as @Joe Green
Any suggestions?

Vishnu Ilango 0 Reputation points

2023-03-25T00:32:40.6166667+00:00

Any luck with this yet mate? I have been having the same issue and tried most options Google can offer.
Matias Diaz Besoain 0 Reputation points

2023-04-10T14:14:44.6866667+00:00

@Sam Wu-MSFT Any luck with this?
PN 0 Reputation points

2024-02-15T12:34:17.7733333+00:00

For anyone battling with this - try setting also this header: Access-Control-Allow-Headers: Allow-Control-Allow-Origin
(and possibly other, comma separated values)

It's apparently not enough to set the
Access-Control-Allow-Origin: * (or a list of allowed origins) but you also need to allow Allow-Control-Allow-Headers header to be processed/used. I'm setting this in ColdFusion, but it should be the same, as if you set it in IIS manager or site header config.

Share via

Allow CORS: Access-Control-Allow-Origin not working

1 answer

Your answer