CORS support for PUT and DELETE with ASP.NET Web API

Question

I am working with the final version of ASP.NET Web API to implement a JavaScript-friendly API. Per various tutorials, I have enabled CORS in my web.config:

<system.webServer>
 <httpProtocol>
  <customHeaders>
    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Headers" value="Content-Type" />
  </customHeaders>
 </httpProtocol>
</system.webServer>

With the above, cross-domain GET and POST requests work fine, but PUT and DELETE requests both fail.

In Chrome:

Method PUT is not allowed by Access-Control-Allow-Methods.

Method DELETE is not allowed by Access-Control-Allow-Methods.

Is there something additional required to get PUT and DELETE verbs working cross-domain?

Do you have a global CORS handler aswell? Or did you fix the CORS in the web.config only? — Are Almaas
– Are Almaas, Commented Apr 26, 2013 at 9:04

Nathan Taylor · Accepted Answer · 2012-09-20 22:11:33Z

55

It looks like adding another custom header sorted it out:

<system.webServer>
 <httpProtocol>
  <customHeaders>
    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Headers" value="Content-Type" />
    <add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS" />
  </customHeaders>
 </httpProtocol>
</system.webServer>

answered Sep 20, 2012 at 22:11

Nathan Taylor

24.7k20 gold badges102 silver badges158 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Alex Jin Over a year ago

This doesn't work for me. Only works for GET and POST.

whyleee · Accepted Answer · 2012-12-27 16:31:42Z

34

Also, in addition to Nathan answer, make sure you disabled WebDAV IIS module and set runAllManagedModulesForAllRequests="true" setting in the web.config:

<system.webServer>
  <modules runAllManagedModulesForAllRequests="true">
    <remove name="WebDAVModule"/>
  </modules>
  <handlers>
    <remove name="WebDAV" />
  </handlers>
</system.webServer>

Without this, preflight CORS requests (which are used for PUT, DELETE methods and send additional OPTIONS request) will not work.

edited Dec 27, 2012 at 16:31

answered Dec 21, 2012 at 0:06

whyleee

4,0591 gold badge33 silver badges33 bronze badges

4 Comments

Are Almaas Over a year ago

Ah thanks! My CORS handler wasn't working without those lines of code in web.config.

Jim Aho Over a year ago

What is the WebDAV handler doing, and why does it need to be removed?

Cuong Nguyen Over a year ago

@JimAho: nice explaination is here: asp.net/web-api/overview/testing-and-debugging/…

Ananda G Over a year ago

OMG!!! I have expend almost 7 days for this!! and luckily i got it. Similar problem was for me. problem was for only PUT + DELETE . Finally Solved, thanks.

Felipe Oriani · Accepted Answer · 2016-02-18 22:30:07Z

9

Very simple solution to overcome CORS Issue in WEBAPI2.2.

Add the following in you WebApi Config File.

var cors = new EnableCorsAttribute("*", "*", "*");
Config.EnableCors(cors);

Before adding this make sure you remove the custom header in the Web.config file.

    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Credentials" value="true" />
    <add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept, X-Token" />
    <add name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE,OPTIONS" />

If you have both customheader as well the CORS enabled in WebApiconfig, you will face the cors error.

Add the cors enabled in WebApi config will solve the issue.

edited Feb 18, 2016 at 22:30

Felipe Oriani

38.7k20 gold badges141 silver badges203 bronze badges

answered May 22, 2015 at 8:11

Praveen Thangaraja

1111 silver badge1 bronze badge

2 Comments

atconway Over a year ago

This is a good current solution and a good explanation. As you mentioned make sure both configurations don't exist (WebApiConfig.cs and Web.config) or the CORS configuration will have a conflict and result in a The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:1234, *', but only one is allowed. error.

atconway Over a year ago

In addition, one needs the following NuGet package to use the EnableCorsAttribute class: nuget.org/packages/Microsoft.AspNet.WebApi.Cors

Debendra Dash · Accepted Answer · 2016-04-15 08:48:48Z

Please use this in web.config while you deployed your application,dont use in local web.config

    <system.webServer>
  <httpProtocol>
      <customHeaders>
        <add name="Access-Control-Allow-Origin" value="*" />
        <add name="Access-Control-Allow-Headers" value="Content-Type" />
        <add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS" />
      </customHeaders>
    </httpProtocol>
 <ModSecurity enabled="false" configFile="C:\inetpub\wwwroot\owasp_crs\modsecurity.conf" />
    <validation validateIntegratedModeConfiguration="false" />
    <handlers>
      <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
      <remove name="OPTIONSVerbHandler" />
      <remove name="TRACEVerbHandler" />
      <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>

  </system.webServer>

Ibere Spadoto · Accepted Answer · 2019-02-19 13:28:38Z

0

Try to comment the line: <remove name="OPTIONSVerbHandler" /> in <handlers> tag

answered Feb 19, 2019 at 13:28

Ibere Spadoto

17113 bronze badges

Collectives™ on Stack Overflow

CORS support for PUT and DELETE with ASP.NET Web API

5 Answers 5

1 Comment

4 Comments

2 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

1 Comment

4 Comments

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related