i am using angularjs and django-cors-headers then give “which is disallowed for cross-origin requests that require preflight.”

[saeedghx68]

I have a Django local sever that refer to 8000 port number, And a local nginx that load 2080 port number html page.

I install django-cross-header package for resolving cross-domain error.

django-cross-header config in settings.py:

CORS_ALLOW_CREDENTIALS = True


CORS_ORIGIN_ALLOW_ALL = True

  CORS_ALLOW_HEADERS = (
         'x-requested-with',
         'content-type',
         'accept',
         'origin',
         'authorization',
         'x-csrftoken'
 )

  CORS_ORIGIN_WHITELIST = (
          '127.0.0.1:2080',
          'localhost:2080'
  )

Config angularjs is like this:

portman.config(function ($routeProvider, $interpolateProvider, $httpProvider) {
     $routeProvider.otherwise('/');
     $httpProvider.defaults.headers.common['X-CSRFToken'] = csrftoken;
     $interpolateProvider.startSymbol('{$').endSymbol('$}');
     delete $httpProvider.defaults.headers.common['X-Requested-With'];

 });
 portman.constant('ip','http://127.0.0.1:8000/');

Get method code in angularjs is:

$http({
         method: 'GET',
         url: ip+'api/v1/dslam/events',
     }).then(function (result) {
        $scope.dslam_events = result.data;
     }, function (err) {

    });

request header is :

Provisional headers are shown
Accept:application/json, text/plain, */*
Origin:http://127.0.0.1:2080
Referer:http://127.0.0.1:2080/
User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36
X-CSRFToken:ztouFO8vldho97bWzY9mHQioFk3j6h5V

After loading the page I see this error:

XMLHttpRequest cannot load http://127.0.0.1:8000/api/v1/dslam/events.The request was redirected to 'http://127.0.0.1:8000/api/v1/dslam/events/', which is disallowed for cross-origin requests that require preflight.

But when i send request from console it will corectly response from django server, my jquery code :

$.ajax({
            type: 'GET',
            url: "http://5.202.129.160:8020/api/v1/dslam/events/",
            success:function(data){
             console.log(data);
            }
        });

request header is:

Accept:*/*
Accept-Encoding:gzip, deflate, sdch
Accept-Language:en-US,en;q=0.8,fa;q=0.6,pt;q=0.4
Connection:keep-alive
Host:127.0.0.1:8000
Origin:http://127.0.0.1:2080
Referer:http://127.0.0.1:2080/
User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36

please help me

[lattsi]

Are you using Django 1.10? If so, django-cors-headers won't work anymore because it doesn't support 1.10. See this issue.

[adamchainz]

Duplicate of #105