SEC7123 CORS on Microsoft Edge

Question

I am making POST request to cross-origin API using angular $http.post. Everything works fine on Chrome or Firefox. The problem occures on Edge:

SEC7123: [CORS] The origin blocked a preflight request where Request Header 'Content-Type' was not present in the Access-Control-Allow-Headers response header list for a cross-origin request to .

First it creates OPTIONS Request where in Access-Control-Allow-Headers section I can see Content-Type. Then error occures. I tried various headers, XHR, Ajax, everytime it is the same.

JS Code:

   const config =  {
        cache: false,
        headers : {
            'Content-Type': 'application/json;charset=utf-8;'
        }
    };

    const params = {
        ip_address: window.ip
    };

    return $http.post(url, params, config);

Answer 1

It was about Edge and IE not able to merge multiple ACAH in a single response. So it was backend issue.

Even that Chrome, Firefox etc. can merge it we should not use multiple line headers in API. The right syntax(from mozilla developer site) is:

Access-Control-Allow-Headers: <header-name>, <header-name>