1

I have an error with CORS:

"XMLHttpRequest cannot load http://graphql-swapi.parseapp.com/. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access. The response had HTTP status code 405."

Error when I call a service method.

Code Snippet:

let headers = new Headers();
headers.append('Access-Control-Allow-Origin', '*');
headers.append('Content-Type', 'application/json'); 
headers.append('Accept', 'application/json');
headers.append('Access-Control-Allow-Methods', 'POST');
headers.append('Access-Control-Allow-Headers', 'Content-Type');

//console.log(headers);

return this._http.post(apiUrl, { query: query, vars: '{}' }, { headers: headers })
  .map(res => res.json().data.planets);

When I disable CORS in the browser, I get:

XMLHttpRequest cannot load xxx. Response for preflight has invalid HTTP status code 405 error.

A query and code is for sure correct.

fragilewindows
  • 1,394
  • 1
  • 15
  • 26
R.Boguslawski
  • 35
  • 1
  • 5
  • Possible duplicate of ["No 'Access-Control-Allow-Origin' header is present on the requested resource"](http://stackoverflow.com/questions/20035101/no-access-control-allow-origin-header-is-present-on-the-requested-resource) – georgeawg Nov 27 '16 at 17:13

1 Answers1

0

The response had HTTP status code 405

Look that up:

405 Method Not Allowed

Response to preflight request

Look that up:

"preflighted" requests first send an HTTP request by the OPTIONS method to the resource on the other domain, in order to determine whether the actual request is safe to send

Your server side code is, presumably, set up to add the CORS headers to the response to a POST request, but you haven't set it up to handle an OPTIONS request at all.

Quentin
  • 914,110
  • 126
  • 1,211
  • 1,335
  • How can I solve it? I have to change server code or just something in app code? – R.Boguslawski Nov 27 '16 at 14:22
  • You have to change the server code so it can handle the options request. – Quentin Nov 27 '16 at 14:25
  • You should also change the client side code so it isn't trying to set the CORS **response** headers as if they were **request** headers. Your code can't give itself permission to access other sites, that would make having the restriction pointless. – Quentin Nov 27 '16 at 14:26