# Traefik headers middleware is not handling CORS preflight request
**URL:** https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266
**Category:** Traefik v2
**Tags:** middleware
**Created:** [January 10, 2021, 1:22am UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266 "2021-01-10T01:22:09Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@bendavis78](https://community.traefik.io/u/bendavis78)
#### Post date: [January 10, 2021, 1:22am UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/1 "2021-01-10T01:22:09Z")
I have the following middleware defined:
```auto
[http.middlewares.cors-allow.headers]
accessControlAllowHeaders = ["Authorization"]
accessControlAllowMethods = ["GET", "HEAD", "OPTIONS"]
accessControlAllowOrigin = "*"
accessControlAllowCredentials = true
```
When performing an OPTIONS request on the URL (tried using curl), traefik does not handle the response, and instead passes it through to the service, which does not handle OPTIONS requests. This breaks CORS preflight requests.
What am I doing wrong? How can I troubleshoot this?
---
### Author:  [@cakiwi](https://community.traefik.io/u/cakiwi)
#### Post date: [January 11, 2021, 12:33am UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/2 "2021-01-11T00:33:09Z")
Can you share your test curl ?
```auto
curl -i -X OPTIONS -H 'Origin: https://example.com' -H 'access-control-request-method: GET' https://api.example.com/info
HTTP/2 200
access-control-allow-credentials: true
access-control-allow-headers: Authorization,Origin,Content-Type,Accept
access-control-allow-methods: GET,POST,HEAD,PUT,DELETE,PATCH,OPTIONS
access-control-allow-origin: https://example.com
access-control-max-age: 0
content-length: 0
date: Mon, 11 Jan 2021 00:31:25 GMT
```
---
### Author:  [@bendavis78](https://community.traefik.io/u/bendavis78)
#### Post date: [January 11, 2021, 6:15am UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/3 "2021-01-11T06:15:46Z")
@cakiwi
```auto
$ curl -i -X OPTIONS -H 'Origin https://example.com' -H 'access-control-request-method: GET' http://robotben-test-project.ide.localdomain/
HTTP/1.1 400 Bad Request: invalid header name
Content-Type: text/plain; charset=utf-8
Connection: close
400 Bad Request: invalid header name
```
[edit] Here are both configs in full (these are two separate files in the traefik config dir):
### base.toml:
```auto
[http.routers.ide-controller]
rule = "Host(`controller.ide.localdomain`)"
service = "ide-controller"
[http.routers.dashboard]
rule = "Host(`dashboard.ide.localdomain`)"
service = "api@internal"
middlewares = ["dashboard-auth"]
[[http.services.ide-controller.loadBalancer.servers]]
url = "http://app:3000"
[http.middlewares.cors-allow.headers]
accessControlAllowHeaders = "*"
accessControlAllowMethods = "*"
accessControlAllowOrigin = "*"
accessControlAllowCredentials = true
[http.middlewares.auth-handler.forwardAuth]
address = "http://app:3000/auth"
trustForwardHeader = true
[http.middlewares.dashboard-auth.basicAuth]
users = ["admin:XXXXXXXXXXXXXXXXXXXXXXXX"]
```
### theia-deployment--robotben--test-project.toml:
```auto
[http.routers.theia-deployment--robotben--test-project]
rule = "Host(`robotben-test-project.ide.localdomain`) || HostRegexp(`{webview:[^.]}.webview.robotben-test-project.ide.localdomain`)"
service = "theia-deployment--robotben--test-project"
middlewares = ["cors-allow"]
[http.routers.theia-deployment--robotben--test-project--preview]
rule = "Host(`preview.robotben-test-project.ide.localdomain`)"
service = "theia-deployment--robotben--test-project--preview"
[[http.services.theia-deployment--robotben--test-project.loadBalancer.servers]]
url = "http://172.24.0.5:3000"
[[http.services.theia-deployment--robotben--test-project--preview.loadBalancer.servers]]
url = "http://172.24.0.5:8080"
```
---
### Author:  [@cakiwi](https://community.traefik.io/u/cakiwi)
#### Post date: [January 11, 2021, 1:27pm UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/4 "2021-01-11T13:27:18Z")
> [@bendavis78](#):
>
> `400 Bad Request: invalid header name`
You missed the `:` after Origin
> [@bendavis78](#):
>
> ```auto
> accessControlAllowHeaders = "*"
> accessControlAllowMethods = "*"
>
> ```
I really don't know if `*` is allowed here, maybe someone else knows. I might have time for a test later.
---
### Author:  [@bendavis78](https://community.traefik.io/u/bendavis78)
#### Post date: [January 11, 2021, 7:53pm UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/5 "2021-01-11T19:53:37Z")
Ok, I've found the issue seems to be sporadic. I'm seeing this message in the logs:
```auto
middleware \"cors-allow@file\" does not exist
```
Which is odd, b/c the middleware is definitely there in the base config.I'm not changing or updating the base config at any time. But sometimes when I touch-update the individual deployment config, the middleware loads successfully.
Is there some race condition that can occur when updating configs that causes the middleware to not be found?
Should I instead be defining middleware with each individual deployment config and not the base config?
---
### Author:  [@cakiwi](https://community.traefik.io/u/cakiwi)
#### Post date: [January 11, 2021, 8:32pm UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/6 "2021-01-11T20:32:55Z")
Check the log at startup. Maybe with `--loglevel=DEBUG`. I'm guessing an error on loading that middleware.
As per [Cors Headers](https://doc.traefik.io/traefik/middlewares/headers/#cors-headers)
This is the way I do it, lists of methods and origins, but using docker labels.
I'm not too savvy with the TOML I use yaml when I have to do a file provider/config, so I cannot parse a
```toml
[http.middlewares]
[http.middlewares.testHeader.headers]
accessControlAllowMethods= ["GET", "OPTIONS", "PUT"]
accessControlAllowOriginList = ["https://foo.bar.org","https://example.org"]
accessControlMaxAge = 100
addVaryHeader = true
```
> [@bendavis78](#):
>
> Should I instead be defining middleware with each individual deployment config and not the base config?
I define it on the traefik service using labels. A file provider defining the middleware should work just as well.
---
### Author:  [@mshajarrazip](https://community.traefik.io/u/mshajarrazip)
#### Post date: [December 18, 2022, 4:29am UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/7 "2022-12-18T04:29:23Z")
I defined it on the traefik service using labels also, like so:
```auto
services:
reverse-proxy:
image: traefik:v2.9
ports:
- ${API_PORT}:80
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./traefik.yml:/etc/traefik/traefik.yml
labels:
- "traefik.http.middlewares.cors.headers.accesscontrolallowmethods=*"
- "traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist=*"
- "traefik.http.middlewares.cors.headers.accesscontrolmaxage=100"
- "traefik.http.middlewares.cors.headers.addvaryheader=true"
```
Doesn't work though 😕
---
### Author:  [@leopedroso45](https://community.traefik.io/u/leopedroso45)
#### Post date: [December 11, 2023, 12:00am UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/8 "2023-12-11T00:00:45Z")
Nothing here?
I'm facing the same issue...
```lml
http:
middlewares:
cors:
headers:
sslRedirect: true
accessControlMaxAge: 100
addVaryHeader: true
accessControlAllowCredentials: true
accessControlAllowMethods:
- OPTIONS
- POST
- GET
- PUT
- DELETE
- PATCH
accessControlAllowHeaders: "*"
accessControlAllowOriginList:
- "*"
- 'http://localhost:5173'
```
```yml
traefik:
image: traefik:latest
command:
- "--api.dashboard=true"
- "--api.debug=true"
- "--log.level=DEBUG"
- "--api.insecure=true"
- "--providers.docker=true"
- "--providers.file.filename=/etc/traefik/dynamic_conf.yml"
ports:
- "80:80"
- "8080:8080"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./dynamic_conf.yml:/etc/traefik/dynamic_conf.yml
auth-service:
build: ./services/auth-service
ports:
- 8081:8081
labels:
- traefik.enable=true
- traefik.http.routers.auth-service.rule=(Host(`soud.localhost`) && PathPrefix(`/auth`))
- "traefik.http.routers.auth-service.middlewares=cors@file"
env_file:
- ./services/auth-service/.env
depends_on:
- mongodb
- traefik
```
---
### Author:  [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [December 11, 2023, 5:48am UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/9 "2023-12-11T05:48:34Z")
Is that config even working? Where is your `entrypoint` (listening port)?
Compare with [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt).
---
### Author:  [@leopedroso45](https://community.traefik.io/u/leopedroso45)
#### Post date: [December 11, 2023, 4:39pm UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/10 "2023-12-11T16:39:28Z")
Yeah, that config worked correctly because of the **ports** and the **providers.docker=true**. Initially, I overlooked the necessity of defining the HTTPS listening port.
I appreciate you sharing your repo to the Traefik example. It was immensely helpful in addressing several questions I had.
Ultimately, I discovered the root cause of my configuration issue. It stemmed from modifications I had previously made to the host file, which resulted in the localhost:8080 address no longer being reachable.
Again, thanks so much friend, you are a good friend!
---
### Author:  [@cakiwi](https://community.traefik.io/u/cakiwi)
#### Post date: [December 16, 2023, 1:00pm UTC](https://community.traefik.io/t/traefik-headers-middleware-is-not-handling-cors-preflight-request/9266/11 "2023-12-16T13:00:44Z")
This topic was automatically closed after 4 days. New replies are no longer allowed.