角度的CORS错误

Question

This may be a duplicate question but I have combed stackoverflow and haven't been able to resolve this issue. We have a custom back end in c# and front end in angularjs trying to make some http requests (GET, POST, PUTT, DELETE). We have the back end running on port 33805 and front end on 8080. I've verified that the actual code is fine. The GET calls work fine. Its when I try doing other calls that we get the issue. Here is the header for the request of a POST:

OPTIONS /api/users/HTTP/1.1
**Client**
    Accept: */*
    Accept-Encoding: gzip, deflate, sdch
    Accept-Language: en-US,en;q=0.8 User-Agent:Mozilla/5.0(Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrone/44.0.2403.107 Safari/537.36
**Miscellaneous**
    Access-Control-Request-Headers: accept, content-type
    Access-Control-Request-Method: POST
    Origin: http://localhost:8080
    Referer: http://localhost:8080/VM/?newPassword=NewPassword3&rePassword=NewPassword3
**Transport**
    Connection: keep-alive
    Host: localhost:33805

Here is the header for the response:

HTTP/1.1 405 Method Not Allowed
**Cache**
    Cache-Control: no-cache
    Date: Tue, 04 Aug 2015 16:00:31 GMT
    Expires: -1
    Pragma: no-cache
**Entity**
    Content-Length: 76
    Content-Type: application/json; charset=utf-8
**Miscellaneous**
    Server: Microsoft-IIS/8.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-SourceFiles: =?UTF-8?B?QzpcVXNlcnNcZGVyaWNrM1xEb2N1bWVudHNcd29ya3NwYWNlXFZlbmRvck1hbmFnZW1lbnRTZXJ2aWNlc1xWZW5kb3JNYW5hZ2VtZW50U2VydmljZXNcYXBpXHVzZXJzXA==?=
**Security**
    Access-Control-Allow-Headers: AUTHORIZATION, X-CLIENT-ID, X-CLIENT_SECRET
    Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
    Access-Control-Allow-Origin: *

I am simply trying to add a user to the system. If it helps the error I'm getting in the console on chrome reads:

XMLHttpRequest cannot load http://localhost:33805/api/users/ . Invalid HTTP status code 405

Again I know there are many questions about CORS and setting it up and what not but I feel like I've followed them all and still am not sure whats going on. Thanks

Answer 1

Can you make your server return the below header and try again?

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Your server do supports CORS as it returns below header.

Access-Control-Allow-Origin: *

So seems like the issue is with allowed-headers returned by the server

Answer 2

You will have to allow it on the server side. In IIS7 you can do this: (add this in your apps web.config)

<customHeaders>
   <add name="Access-Control-Allow-Origin" value="*" />
 </customHeaders>

In Tomcat you can add cors filter in web.xml.