diff --git a/src/Microsoft.AspNetCore.Cors/Infrastructure/CorsService.cs b/src/Microsoft.AspNetCore.Cors/Infrastructure/CorsService.cs index 0ec9c030f3d8128d0256a3466dba1dacfe559394..0d52489d819d36348471ba359482d14dafa1c951 100644 --- a/src/Microsoft.AspNetCore.Cors/Infrastructure/CorsService.cs +++ b/src/Microsoft.AspNetCore.Cors/Infrastructure/CorsService.cs @@ -92,9 +92,14 @@ namespace Microsoft.AspNetCore.Cors.Infrastructure var origin = context.Request.Headers[CorsConstants.Origin]; var requestHeaders = context.Request.Headers; - var isPreflightRequest = - string.Equals(context.Request.Method, CorsConstants.PreflightHttpMethod, StringComparison.OrdinalIgnoreCase) && - requestHeaders.ContainsKey(CorsConstants.AccessControlRequestMethod); + + var isOptionsRequest = string.Equals(context.Request.Method, CorsConstants.PreflightHttpMethod, StringComparison.OrdinalIgnoreCase); + var isPreflightRequest = isOptionsRequest && requestHeaders.ContainsKey(CorsConstants.AccessControlRequestMethod); + + if (isOptionsRequest && !isPreflightRequest) + { + _logger.IsNotPreflightRequest(); + } var corsResult = new CorsResult { diff --git a/src/Microsoft.AspNetCore.Cors/Internal/CORSLoggerExtensions.cs b/src/Microsoft.AspNetCore.Cors/Internal/CORSLoggerExtensions.cs index d324aba1cf1b8d5b56d3ff1c31aeae3bf3d1bdf1..ee6533bbed4af75ba73a10a1f1018eb96ef96946 100644 --- a/src/Microsoft.AspNetCore.Cors/Internal/CORSLoggerExtensions.cs +++ b/src/Microsoft.AspNetCore.Cors/Internal/CORSLoggerExtensions.cs @@ -19,6 +19,7 @@ namespace Microsoft.AspNetCore.Cors.Internal private static readonly Action<ILogger, Exception> _failedToSetCorsHeaders; private static readonly Action<ILogger, Exception> _noCorsPolicyFound; private static readonly Action<ILogger, Exception> _insecureConfiguration; + private static readonly Action<ILogger, Exception> _isNotPreflightRequest; static CORSLoggerExtensions() { @@ -76,6 +77,11 @@ namespace Microsoft.AspNetCore.Cors.Internal LogLevel.Warning, new EventId(11, "CorsInsecureConfiguration"), "The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time. Configure the policy by listing individual origins if credentials needs to be supported."); + + _isNotPreflightRequest = LoggerMessage.Define( + LogLevel.Debug, + new EventId(12, "OptionsRequestWithoutAccessControlRequestMethodHeader"), + "This request uses the HTTP OPTIONS method but does not have an Access-Control-Request-Method header. This request will not be treated as a CORS preflight request."); } public static void IsPreflightRequest(this ILogger logger) @@ -132,5 +138,10 @@ namespace Microsoft.AspNetCore.Cors.Internal { _insecureConfiguration(logger, null); } + + public static void IsNotPreflightRequest(this ILogger logger) + { + _isNotPreflightRequest(logger, null); + } } }