title: CORS issue only on PUT on .NET5
body: <p>I'm getting <code>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://mysiteapi.domain.com/api/v1.0/operations/1. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).</code> when trying to do a PUT request to my .NET5 WebAPI.</p>
  <p>These are the methods I've added CORS to the API:</p>
  <pre><code>        public static void AddCustomCors(this IServiceCollection services, IWebHostEnvironment env, IConfiguration config)
          {
              var cors = config.GetSection(&quot;Cors&quot;).Get&lt;CorsSettings&gt;();
              if (!cors.Enabled)
              {
                  return;
              }
  
              services.AddCors(options =&gt;
              {
                  options.AddPolicy(&quot;Default&quot;,
                      builder =&gt;
                      {
                          builder.WithExposedHeaders(cors.ExposedHeaders)
                              .WithHeaders(cors.Headers)
                              .WithMethods(cors.Methods);
                              .WithOrigins(cors.Origins);
  
                      });
              });
          }
  
          public static void UseCustomCors(this IApplicationBuilder app, IConfiguration config)
          {
              var cors = config.GetSection(&quot;Cors&quot;).Get&lt;CorsSettings&gt;();
              if (cors.Enabled)
              {
                  app.UseCors(&quot;Default&quot;);
              }
          }
  </code></pre>
  <p>They are called in <code>Startup.cs</code> as the first methods in <code>ConfigureServices</code> and <code>Configure</code> respectively.
  The settings look like this:</p>
  <pre><code>  &quot;Cors&quot;: {
      &quot;Enabled&quot;: true,
      &quot;Origins&quot;: [ &quot;http://mysite.domain.com&quot; ],
      &quot;ExposedHeaders&quot;: [ &quot;X-Request-Id&quot;, &quot;X-Request-Duration&quot; ],
      &quot;Headers&quot;: [ &quot;Content-Type&quot;, &quot;Authorization&quot;, &quot;X-Requested-With&quot; ],
      &quot;Methods&quot;: [ &quot;OPTIONS&quot;, &quot;GET&quot;, &quot;POST&quot;, &quot;PUT&quot;, &quot;DELETE&quot; ]
    }
  </code></pre>
  <p>GET requests work but not PUT. Checking the Network browser tab I see that the OPTIONS request is ok and I can see my settings being added but in the PUT request they are missing.
  The OPTIONS request and response:</p>
  <pre><code>OPTIONS /api/v1.0/operations/1 HTTP/2
  Host: mysiteapi.domain.com
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate, br
  Access-Control-Request-Method: PUT
  Access-Control-Request-Headers: authorization,content-type
  Referer: https://mysite.domain.com/operation/edit/1
  Origin: https://mysite.domain.com
  Connection: keep-alive
  TE: Trailers
  
  
  HTTP/2 204 No Content
  server: Microsoft-IIS/10.0
  access-control-allow-origin: https://mysite.domain.com
  access-control-allow-headers: Content-Type,Authorization,X-Requested-With,Origin
  access-control-allow-methods: OPTIONS,GET,POST,PUT,DELETE
  x-powered-by: ASP.NET
  x-powered-by-plesk: PleskWin
  date: Thu, 28 Jan 2021 16:21:49 GMT
  X-Firefox-Spdy: h2
  
  </code></pre>
  <p>The PUT request and response:</p>
  <pre><code>PUT /api/v1.0/operations/1 HTTP/2
  Host: mysiteapi.domain.com
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
  Accept: application/json, text/plain, */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate, br
  Authorization: Bearer &lt;token&gt;
  Content-Type: application/json
  Content-Length: 353
  Origin: https://mysite.domain.com
  Connection: keep-alive
  Referer: https://mysite.domain.com/operation/edit/1
  TE: Trailers
  
  HTTP/2 405 Method Not Allowed
  allow: GET, HEAD, OPTIONS, TRACE
  content-type: text/html
  server: Microsoft-IIS/10.0
  x-powered-by: ASP.NET
  x-powered-by-plesk: PleskWin
  date: Thu, 28 Jan 2021 16:21:49 GMT
  content-length: 12591
  X-Firefox-Spdy: h2
  </code></pre>
  <p>The API is on a web host running in IIS in Plesk 18.0.32. The web.config is as follows:</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&gt;
  &lt;configuration&gt;
    &lt;location path=&quot;.&quot; inheritInChildApplications=&quot;false&quot;&gt;
      &lt;system.webServer&gt;
        &lt;handlers&gt;
          &lt;add name=&quot;aspNetCore&quot; path=&quot;*&quot; verb=&quot;*&quot; modules=&quot;AspNetCoreModuleV2&quot; resourceType=&quot;Unspecified&quot; /&gt;
        &lt;/handlers&gt;
        &lt;aspNetCore processPath=&quot;dotnet&quot; arguments=&quot;.\MySite.WebApi.dll&quot; stdoutLogEnabled=&quot;true&quot; stdoutLogFile=&quot;.\logs\stdout&quot; hostingModel=&quot;InProcess&quot; /&gt;
      &lt;/system.webServer&gt;
    &lt;/location&gt;
  
    &lt;/system.webServer&gt;
    &lt;system.web&gt;
      &lt;compilation tempDirectory=&quot;C:\Inetpub\vhosts\mysite.com\tmp&quot; /&gt;
      &lt;customErrors mode=&quot;Off&quot; /&gt;
    &lt;/system.web&gt;
  &lt;/configuration&gt;
  </code></pre>
  <p>I suspected this was a problem with the web.config so I've tried:</p>
  <ol>
  <li>adding the <code>Access-Control-Allow-Origin</code> as a custom header in web.config - this resulted in an error because they were being added twice</li>
  <li>removing the CORS stuff from the API and having them added only from web.config - resulted in errors about the preflight request</li>
  <li>removing the header through web.config and then adding it - resulted in an error (preflight I think)</li>
  <li>adding the configuration from <a href="https://docs.microsoft.com/en-us/iis/extensions/cors-module/cors-module-configuration-reference" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/iis/extensions/cors-module/cors-module-configuration-reference</a> to the web.config - also resulted in an error</li>
  </ol>
  <p>Has anyone else encountered this problem?</p>