title: In .Net Core 2.1 Web API for PUT and DELETE only why "No 'Access-Control-Allow-Origin' header is present on the requested resource"
body: <p>I am using .NET Core 2.1. I have configured Startup.cs as follow: </p>
  
  <pre><code>public class Startup
  {   
       public static IConfiguration Configuration { get; private set; }
  
       public Startup(IConfiguration configuration)
       {
           Configuration = configuration;
       }
  
  
       public void ConfigureServices(IServiceCollection services)
       {
           services.AddCors();
           services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
       }
  
       public void Configure(IApplicationBuilder app, IHostingEnvironment env)
       {
           app.UseCors(builder =&gt; builder.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader());
  
           if (env.IsDevelopment())
           {
               app.UseDeveloperExceptionPage();
           }
  
           app.UseMvc();
       }
   }
  </code></pre>
  
  <p>Web API is deployed on linux machine. <code>GET</code> and <code>POST</code> methods are working fine. When I try to call <code>PUT</code> or <code>DELETE</code> this message is being generated in <code>Chroome</code> console. </p>
  
  <p><code>Access to XMLHttpRequest at 'http://IP' from origin 'http://IP' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.</code> </p>
  
  <p>Initially Kestrel was listing on <code>50001</code> beacuse SSL certificate was present. I configured Kestrel in <code>appsettings.json</code> to listen only on <code>5000</code>. So now its only listing on <code>5000</code>.</p>
  
  <p><strong>appsettings.json</strong></p>
  
  <pre><code>{
      "Kestrel": {
          "EndPoints": {
              "Http": {
                  "Url": "http://localhost:5000"
              }
          }
      }
  }
  </code></pre>
  
  <p>I've tried almost every answer given in this thread <a href="https://stackoverflow.com/questions/44379560/how-to-enable-cors-in-asp-net-core-webapi">How to enable CORS in ASP.net Core WebAPI</a></p>
  
  <p>None of them worked in my case. </p>
  
  <p><code>Origin</code> is my localhost and Web API is on Live IP.</p>
  
  <p><strong>EDIT 1</strong></p>
  
  <p><strong>Preflight (OPTIONS) Response Headers</strong></p>
  
  <pre><code>HTTP/1.1 204 No Content
  Server: nginx/1.14.0 (Ubuntu)
  Date: Sat, 25 Apr 2020 18:50:50 GMT
  Connection: keep-alive
  Access-Control-Allow-Headers: authtoken,authuser,content-type
  Access-Control-Allow-Methods: PUT
  Access-Control-Allow-Origin: *
  </code></pre>
  
  <p><strong>Preflight (OPTIONS) Request Headers</strong> </p>
  
  <pre><code>OPTIONS /Foo/Controller HTTP/1.1
  Host: MY LINUX Machine Live IP
  Connection: keep-alive
  Access-Control-Request-Method: PUT
  Origin: http://localhost:8080
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36
  Access-Control-Request-Headers: authtoken,authuser,content-type
  Accept: */*
  Referer: http://localhost:8080/xyz
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  </code></pre>
  
  <p><strong>Actual Request (Request Headers)</strong></p>
  
  <pre><code>PUT /Foo/Controller HTTP/1.1
  Host: Linux IP
  Connection: keep-alive
  Content-Length: 63
  Accept: application/json, text/javascript, */*; q=0.01
  Origin: http://localhost:8080
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36
  Content-Type: application/json
  Referer: http://localhost:8080/xyz
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  </code></pre>
  
  <p><strong>Actual Request (Response Headers)</strong></p>
  
  <pre><code>HTTP/1.1 500 Internal Server Error
  Content-Type: text/html
  Content-Length: 225
  Connection: Close
  </code></pre>