Missing Patch method with corsheaders only on chrome

Question

I have a Django app that's using corsheaders package and its in settings.py like this:

INSTALLED_APPS = [ ..., corsheaders, ...]
...
MIDDLEWARE = [
    # on top
    "corsheaders.middleware.CorsMiddleware",
    "django.middleware.common.CommonMiddleware",
    ...
]
...
CORS_ORIGIN_ALLOW_ALL = True
CORS_ALLOW_CREDENTIALS = True

When I'm trying to do a PATCH request on Google Chrome after the OPTIONS method I get this:

The Access-Control-Allow-Methods is missing PATCHand the next request fails with CORS methods error.

But I tried the same method on Firefox and its working as intended.

user_2873538 · Answer

Seems like you need to set allowed origins explicitly, not by using the wildcard i.e. *:

CORS_ALLOWED_ORIGINS = [
    "https://example.com",
    "https://sub.example.com",
    "http://localhost:8080",
    "http://127.0.0.1:9000"
]

Also, set all HTTP verbs:

CORS_ALLOW_METHODS = [
    'DELETE',
    'GET',
    'OPTIONS',
    'PATCH',
    'POST',
    'PUT',
]

Missing Patch method with corsheaders only on chrome

1 Answers