title: Method DELETE is not allowed by Access-Control-Allow-Methods in preflight response
body: <p>I am trying to make a DELETE ajax request but I can't seem to make it work. When I make it using POSTMAN it works. Here's my code:</p>
  
  <p>This is my request, made with jQuery's .ajax() method:</p>
  
  <pre><code>$.ajax({
      url: imageUrl,
      type: 'DELETE',
      crossDomain: true
  });
  </code></pre>
  
  <p>On the server, a different app built with node.js + express, I have:</p>
  
  <pre><code>app.use(function(req, res, next) {
      res.header("Access-Control-Allow-Origin", "*");
      res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
      next();
  });
  </code></pre>
  
  <hr>
  
  <p>And finally, these are my Request, Request Headers and Response Headers:</p>
  
  <p><strong>Request</strong></p>
  
  <pre><code>Request URL:http://original/request/url
  Request Method:OPTIONS
  Status Code:200 OK
  Remote Address:75.126.137.93:80 
  </code></pre>
  
  <p><strong>Request Headers</strong></p>
  
  <pre><code>Accept:*
  Accept-Encoding:gzip, deflate, sdch
  Accept-Language:pt-BR,pt;q=0.8,en-US;q=0.6,en;q=0.4,es;q=0.2,gl;q=0.2
  Access-Control-Request-Headers:
  Access-Control-Request-Method:DELETE
  Connection:keep-alive
  Host:fs.bvodola.webfactional.com
  Origin:http://localhost:3000
  Referer:http://localhost:3000/landing/admin/add-page
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
  </code></pre>
  
  <p><strong>Response Headers</strong></p>
  
  <pre><code>Access-Control-Allow-Headers:Origin, X-Requested-With, Content-Type, Accept
  Access-Control-Allow-Origin:*
  Allow:GET,HEAD,DELETE
  Connection:keep-alive
  Content-Length:15
  Content-Type:text/html; charset=utf-8
  Date:Sat, 03 Sep 2016 23:34:17 GMT
  ETag:W/"f-W+bYAIA7Bs2GwQecFLp1SA"
  Server:nginx
  X-Powered-By:Express
  </code></pre>
  
  <p>And in the <strong>Console</strong> i get the following:</p>
  
  <p><em>XMLHttpRequest cannot load <a href="http://original/request/url" rel="nofollow noreferrer">http://original/request/url</a>. Method DELETE is not allowed by Access-Control-Allow-Methods in preflight response.</em></p>
  
  <p><strong>How can I solve this?</strong>
  On some StackOverflow questions I read that Access-Control-Allow-Headers must the same as Access-Control-Request-Headers. But when I try to set it on the jQuery request, I get the following on the console:</p>
  
  <p><em>Refused to set unsafe header "Access-Control-Request-Headers"</em></p>
  
  <p>Any ideas of what might be wrong? Thanks!</p>
  
  <hr>
  
  <p>I have looked at the following StackOverflow questions but couldn't find the answer:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/28990565/delete-is-not-allowed-by-access-control-allow-methods#">DELETE is not allowed by Access-Control-Allow-Methods</a></li>
  <li><a href="https://stackoverflow.com/questions/36374247/always-got-method-delete-is-not-allowed-by-access-control-allow-methods-in-prefl">Always got Method DELETE is not allowed by Access-Control-Allow-Methods in preflight response</a></li>
  <li><a href="https://stackoverflow.com/questions/25630585/access-control-allow-origin-in-preflight-response-doesnt-enable-cross-domain-ac">Access-Control-Allow-Origin in preflight response doesn&#39;t enable cross-domain access</a></li>
  <li><a href="https://stackoverflow.com/questions/25727306/request-header-field-access-control-allow-headers-is-not-allowed-by-access-contr">Request header field Access-Control-Allow-Headers is not allowed by Access-Control-Allow-Headers</a></li>
  </ul>