Method PATCH is not allowed by Access-Control-Allow-Methods in preflight response

I am using nestjs with express and appli the cors library to enable CORS (without any configuration override). Everything worked fine until today. I started to get CORS exception when sending PATCH request:

Method PATCH is not allowed by Access-Control-Allow-Methods in preflight response.

Surprisingly, GET and POST works fine. This is happening only on Chrome. Safari works fine.

Any idea what is missing?

[immortal-tofu]

My solution is not related to the OP issue I think, but maybe.

I have a Chrome plugin (Allow CORS) which allowed me to toggle CORS on different domain. Classic webdev tool. I activated the plugin on localhost:9000 (for a previous project I guess). So, this plugin overwrites all OPTIONS request to make everything allowed. Everything ? No… The default value is GET,HEAD,PUT,POST,DELETE…

My CORS set through cors was correct, but this plugin was breaking my preflight because it didn’t allow PATCH by default. I just disabled the plugin, and everything was working well.

Sorry for the useless comments but maybe it would help someone 😃

[DanielRGilles]

I had this issue and for patch specifically from client side it is important to pass in ‘PATCH’ as the method and not ‘patch’. The other routes will work regardless of capitalization but patch is the oddity in that it must be all caps.