Flask-CORS not working for POST, but working for GET

Question

I'm running a Flask-Restful API locally and sending a POST request containing JSON from a different port. I'm getting the error

No 'Access-Control-Allow-Origin' header is present on the requested resource.

However, when I run

curl --include -X OPTIONS http://localhost:5000/api/comments/3
        --header Access-Control-Request-Method:POST
        --header Access-Control-Request-Headers:Content-Type
        --header Origin:http://localhost:8080

I get

HTTP/1.0 200 OK
Content-Type: text/html; charset=utf-8
Allow: HEAD, GET, POST, OPTIONS
Access-Control-Allow-Origin: http://localhost:8080
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
Vary: Origin
Access-Control-Allow-Headers: Content-Type
Content-Length: 0

which shows "Access-Control-Allow-Origin" as "*". GET works fine, it's just POST that gives this error. What could be going wrong? If relevant, for the frontend I'm using react and requesting through axios.

Answer 1

You have to add CORS(app, resources={r"/*": {"origins": "*"}}) into your flask app.

Hope that solves the issue.

Answer 2

the Flask-Cors docs explain why this might happen

"When using JSON cross origin, browsers will issue a pre-flight OPTIONS request for POST requests. In order for browsers to allow POST requests with a JSON content type, you must allow the Content-Type header. The simplest way to do this is to simply set the CORS_HEADERS configuration value on your application: e.g."

https://flask-cors.readthedocs.io/en/1.9.0/

app.config['CORS_HEADERS'] = 'Content-Type'