CORS won't allow PATCH requests on apache 2.41

Question

I've been trying to use PATCH for an API I'm building. All requests fail because of CORS. I've tried editing my website's .htaccess file to include the following:

Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "PUT, OPTIONS, GET, POST, DELETE"

Yet, it continues saying that "CORS Preflight did not succeed", even though both headers appear as been sent in the request.

I'm using jQuery's ajax method to send the request if that can help.

What did I do wrong? How can I fix that?

Thanks in advance, and sorry if this has already been answered. So far, none of the answers worked.

Answer 1

Does it help if you add PATCH to the list of allowed methods?

Header always set Access-Control-Allow-Methods "PATCH, PUT, OPTIONS, GET, POST, DELETE"

Answer 2

So apparently, the browser disliked that my server was returning a status code other than 200, and thus made it fail CORS preflight.

To fix this, you have to make it so requests coming as OPTIONS always return a 200 OK, no matter what. The browser sends the first request to check CORS as OPTIONS, then a second one as PATCH.

Answer 3

I think it would be easier if you could tell what plattform you are using as server side. It's an apache, nginx web server?

Considering the htaccess information, I'll assume you are using an apache. Are you sure the server has rights for using it?

Your should check in your apache2.conf or httpd.conf and have something similar to that:

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride All # <---- Allow every command from htaccess
        Require all granted
</Directory>

Also, if you are running a linux you should enable mod_rewrite, with something like that:

a2enmod rewrite

Also, just to be sure, your htaccess should start with something like this:

RewriteEngine On

Let me know what are the technologies you are using. I'll try to help you better.