Access-control-allow-methods And Microsoft Edge, Works With Firefox And Chrome

I'm using superagent to execute a DELETE call to my WebApi backend. The pre-flight call says that the Access-Control-Allow-Methods are *, GET, POST, PUT, DELETE, OPTIONS. Using th

Solution 1:

IE Edge will also not accept multiple headers, ie.

Access-Control-Allow-Methods: POSTAccess-Control-Allow-Methods: PUT

and you have to return a single

Access-Control-Allow-Methods: POST, PUT

Solution 2:

Apparently Edge rejects * as a value for Access-Control-Allow-Methods, despite it being grammatically valid under the CORS and HTTP specifications. Note, however, that * does not have semantic significance as a wildcard in Access-Control-Allow-Methods. It literally refers to an HTTP method with the single-character name *. Unless your server actually expects an HTTP method called *, there is no reason to include this method name.

Remove the * from the list to make your request work on Edge.