preflighted OPTIONS request return non-200 about flask-cors HOT 3 CLOSED

@georgexsh the W3 specifications for CORS require user credentials to be excluded from preflight requests. You should add some logic to your before_request handler to check that request.method != 'OPTIONS before aborting with an 401 UNAUTHORIZED resposnse

from flask-cors.

Hey George, can you add some more detail?

I haven't checked this particular usage, but my guess is that it is a limitation in Flask's middleware system. I wonder if @app.after_request handlers are actually called if you abort in the before_request.

Were you able to work around this?

from flask-cors.

@joshfriend that's exactly what I did for now, thanks.
@corydolphin maybe this behavior could be mentioned in the doc.

from flask-cors.