title: CORS missing 'Access-Control-Allow-Methods'
body: <p>I have configured an OpenApi endpoint, but some services fail to connect.</p>
  
  <p>For example Built.io Flows can read the OpenAPI spec (JSON), but crashes when I select an operation, and Azure logic apps tells me there is a potential CORS issue when importing the OpenApi spec.</p>
  
  <p>Other services work correctly though, like:</p>
  
  <ul>
  <li><a href="https://editor.swagger.io/" rel="nofollow noreferrer">https://editor.swagger.io/</a></li>
  <li><a href="https://apidevtools.org/swagger-parser/online/index.html" rel="nofollow noreferrer">https://apidevtools.org/swagger-parser/online/index.html</a></li>
  </ul>
  
  <p>They correctly fetch the OpenApi doc (v3.0.1) and mark it as valid.</p>
  
  <p>To debug the issue I have temporary allowed all methods, origins and headers.</p>
  
  <p>This is the example output of a pre-flight request:</p>
  
  <pre><code>curl --request OPTIONS
    --url https://my-endpoint
    --header 'accept: application/json'
    --header 'access-control-request-headers: X-Test'
    --header 'access-control-request-method: GET'
    --header 'origin: https://flow.built.io'
    --head
  </code></pre>
  
  <p>And response:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Cache-Control: no-store
  Server:
  X-Frame-Options: DENY
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Headers: X-Test
  Access-Control-Max-Age: 60
  X-SourceFiles: =?UTF-8?B?QzpcVXNlcnNcYWFtXFNDSFxzdHlsZWxhYnMubVxzcmNcU3R5bGVsYWJzLk0uUG9ydGFsLldlYi5VSVx2MVxvcGVuYXBpXERlbW9Eb21haW4=?=
  X-Content-Type-Options: nosniff
  Date: Wed, 07 Aug 2019 11:21:01 GMT
  Content-Length: 0
  </code></pre>
  
  <p>The actual request:</p>
  
  <pre><code>  curl --request GET 
    --url https://my-endpoint
    --header 'accept: application/json'
    --header 'origin: https://flow.built.io'
    --head
  </code></pre>
  
  <p>And response:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Cache-Control: no-store
  Content-Length: 775
  Content-Type: application/json; charset=utf-8
  ETag: "Lk4Y9t0X5UEvgxtRUQ0MGoqYu4l4cN53Ji5NpB3lhzI="
  Server:
  X-Frame-Options: DENY
  Access-Control-Allow-Origin: *
  Access-Control-Expose-Headers: *
  X-SourceFiles: =?UTF-8?B?QzpcVXNlcnNcYWFtXFNDSFxzdHlsZWxhYnMubVxzcmNcU3R5bGVsYWJzLk0uUG9ydGFsLldlYi5VSVx2MVxvcGVuYXBpXERlbW9Eb21haW4=?=
  X-Content-Type-Options: nosniff
  Date: Wed, 07 Aug 2019 11:26:00 GMT
  </code></pre>
  
  <p>The CORS headers look correct to me, but the 'Access-Control-Allow-Methods' is missing? Can this be the issue?</p>
  
  <p>I'm using ASP.NET Framework with 'Microsoft.AspNet.WebApi.Cors' 5.2.7, configured as described here <a href="https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api</a></p>
  
  <p>On my controller I have this attribute:</p>
  
  <pre><code>    [EnableCors(origins: "*", headers: "*", methods: "*", exposedHeaders: "*", PreflightMaxAge = 60)]
  </code></pre>