CORS error in PUT and DELETE methods when ASP.NET API is deployed

Question

I implemented an ASP.NET API (.NET 8). All endpoints works as it should when I am debugging, but when I deploy this API into my local IIS, it throws me the following error:

Access to fetch at 'https://localhost:7162/Scene' from origin 'http://localhost:3001' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

This error only happens on HttpPut and HttpDelete endpoints and, as I said, when it is deployed into my local IIS.

I have configured my CORS policies like this:

app.UseCors(x => x
.AllowAnyHeader()
.AllowAnyMethod()
.SetIsOriginAllowed(origin => true)
.AllowCredentials());

If someone could help me on what could be happening, I will be very grateful.

Thanks everyone!

Answer 1

You should add to web.config WebDAVModule and WebDAV in publish files like this:

<system.webServer>
  <modules>
    <remove name="WebDAVModule" />
  </modules>
  <handlers>
    <remove name="WebDAV" />
  </handlers>
</system.webServer>