Web API CORS问题求助：配置web.config允许OPTIONS方法仍无效

Hey there! I totally get how frustrating it is when you’ve set up OPTIONS support in your web.config but still hit CORS errors—been there, debugged that. Let’s walk through the most common fixes and checks to get this sorted out.

Common Causes & Fixes #

1. Incomplete CORS Header Configuration #

Just allowing OPTIONS isn’t enough—you need to make sure all required Access-Control-* headers are properly set. Often, missing headers like Access-Control-Allow-Headers or misconfigured Access-Control-Allow-Origin are the culprit.

Here’s a complete, tested web.config snippet for CORS:

<system.webServer>
  <!-- Configure CORS headers -->
  <httpProtocol>
    <customHeaders>
      <!-- Replace with your frontend domain; avoid * if using credentials -->
      <add name="Access-Control-Allow-Origin" value="https://your-frontend-app.com" />
      <add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS" />
      <!-- Include any custom headers your API uses (like Authorization) -->
      <add name="Access-Control-Allow-Headers" value="Content-Type, Authorization, X-Requested-With" />
      <!-- Set to true only if your app uses credentials (cookies, auth tokens) -->
      <add name="Access-Control-Allow-Credentials" value="true" />
    </customHeaders>
  </httpProtocol>

  <!-- Ensure OPTIONS requests are handled correctly -->
  <handlers>
    <remove name="OPTIONSVerbHandler" />
    <add name="OPTIONSVerbHandler" 
         path="*" 
         verb="OPTIONS" 
         modules="ProtocolSupportModule" 
         resourceType="Unspecified" 
         requireAccess="None" />
  </handlers>
</system.webServer>

2. Conflicting Modules or Middleware #

If you’re using ASP.NET (especially Core), check if there’s CORS middleware configured in your code (like app.UseCors()) that might be overriding your web.config settings. Code-based CORS config takes precedence over web.config in most cases.

Also, look out for URL Rewrite rules or custom HTTP modules that might be intercepting OPTIONS requests before they reach the CORS configuration.

3. Wildcard Origin + Credentials Conflict #

If you set Access-Control-Allow-Origin: * but your frontend sends credentials (like cookies or Authorization headers), browsers will block the request. You must specify the exact frontend domain instead of using a wildcard when credentials are enabled.

4. Verify OPTIONS Response Headers #

Use your browser’s DevTools (Network tab) or a tool like Postman to send an OPTIONS request to your API endpoint. Check the response headers to confirm:

• Access-Control-Allow-Origin matches your frontend domain
• Access-Control-Allow-Methods includes OPTIONS and all the methods your API uses
• Access-Control-Allow-Headers includes all headers your frontend sends

If these headers are missing or incorrect, your web.config configuration isn’t being applied properly—double-check for typos or misplaced nodes (make sure everything is under <system.webServer>).

5. IIS Server Level Restrictions #

Sometimes, IIS itself might block OPTIONS requests at the server level. Check if the server’s request filtering rules allow OPTIONS. You can add this to your web.config to explicitly allow it:

<system.webServer>
  <security>
    <requestFiltering>
      <verbs>
        <add verb="OPTIONS" allowed="true" />
      </verbs>
    </requestFiltering>
  </security>
</system.webServer>

内容的提问来源于stack exchange，提问作者Amita