# CORS Preflight Checks Don't Get Proper Headers
**URL:** https://meta.discourse.org/t/cors-preflight-checks-dont-get-proper-headers/28779
**Category:** Bug
**Created:** [2015年五月13日 17:26 UTC](https://meta.discourse.org/t/cors-preflight-checks-dont-get-proper-headers/28779 "2015-05-13T17:26:28Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@boushleyExtra](https://meta.discourse.org/u/boushleyExtra)
#### Post date: [2015年五月13日 17:26 UTC](https://meta.discourse.org/t/cors-preflight-checks-dont-get-proper-headers/28779/1 "2015-05-13T17:26:28Z")
When trying to make a CORS request that requires a preflight check the response does not contain the proper headers.
Currently I’m trying to implement Single Sign Off and I was told by @sam to use CORS against the session#destory endpoint. When I make a DELETE request CORS does a preflight OPTIONS request. This results in a 404 response that does not have any CORS headers:
```
content-length:0
content-type:text/html; charset=utf-8
date:Wed, 13 May 2015 17:18:14 GMT
server:nginx
status:404 Not Found
status:404 Not Found
version:HTTP/1.1
x-request-id:f816d011-66c5-4a1b-8b09-6772aa9695c9
x-runtime:0.003151
```
I know CORS is configured correctly because calls that don’t result in a 404 have the proper headers in place. It appears that some other piece of middleware after the [CORS rack middleware](https://github.com/discourse/discourse/blob/master/config/initializers/08-rack-cors.rb) is stripping off those headers. The code inside of the CORS middleware appears to be running on these OPTIONS requests, but something else is stripping those headers back off.
Any ideas what middleware or other part of this stack might be sanitizing 404 response headers?
---
### Author:  [@boushleyExtra](https://meta.discourse.org/u/boushleyExtra)
#### Post date: [2015年五月14日 16:50 UTC](https://meta.discourse.org/t/cors-preflight-checks-dont-get-proper-headers/28779/2 "2015-05-14T16:50:32Z")
Looks like @eviltrout fixed this here [963b08f](https://github.com/discourse/discourse/commit/963b08f0639d8c67c9272da23a49582967c3510e)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2015年五月14日 19:45 UTC](https://meta.discourse.org/t/cors-preflight-checks-dont-get-proper-headers/28779/3 "2015-05-14T19:45:16Z")