# CORS Issue: Custom Header Being Blocked by IC Boundary Node
**URL:** https://forum.dfinity.org/t/cors-issue-custom-header-being-blocked-by-ic-boundary-node/40097
**Category:** Developers
**Tags:** Boundary-nodes
**Created:** [January 14, 2025, 11:05pm UTC](https://forum.dfinity.org/t/cors-issue-custom-header-being-blocked-by-ic-boundary-node/40097 "2025-01-14T23:05:50Z")
**Posts on this page:** 5
**Page:** 2
### Author:  [@rbirkner](https://forum.dfinity.org/u/rbirkner)
#### Post date: [July 11, 2025, 8:34am UTC](https://forum.dfinity.org/t/cors-issue-custom-header-being-blocked-by-ic-boundary-node/40097/21 "2025-07-11T08:34:34Z")
Hey @Gekctek,
Just to make sure: do you see the same behavior both locally and on mainnet? Right now, I am not aware of any regression on mainnet (or what would have caused it), but we will of course look into it, if there is an issue.
---
### Author:  [@Gekctek](https://forum.dfinity.org/u/Gekctek)
#### Post date: [July 11, 2025, 4:54pm UTC](https://forum.dfinity.org/t/cors-issue-custom-header-being-blocked-by-ic-boundary-node/40097/22 "2025-07-11T16:54:18Z")
Ya, i am no longer getting CORS OPTIONS preflight handled in the canister, just the default headers. So I am seeing a regression on mainnet
```auto
curl -X OPTIONS \
-H "Access-Control-Request-Method: GET" \
-H "Access-Control-Request-Headers: atproto-accept-labelers" \
-v \
https://sctyd-5qaaa-aaaag-aa5lq-cai.icp0.io/xrpc/com.atproto.server.describeServer
```
```auto
< HTTP/2 200
< access-control-allow-methods: HEAD, GET, POST, PUT, DELETE, PATCH
< access-control-allow-headers: user-agent, dnt, if-none-match, if-modified-since, cache-control, content-type, range, cookie, x-requested-with, x-ic-canister-id, x-oc-jwt, x-oc-api-key
< access-control-max-age: 7200
< access-control-allow-origin: *
< vary: origin, access-control-request-method, access-control-request-headers
```
---
### Author:  [@Gekctek](https://forum.dfinity.org/u/Gekctek)
#### Post date: [July 16, 2025, 2:48pm UTC](https://forum.dfinity.org/t/cors-issue-custom-header-being-blocked-by-ic-boundary-node/40097/23 "2025-07-16T14:48:44Z")
This is very blocking for me
Any thoughts on an ETA or workaround
---
### Author:  [@rbirkner](https://forum.dfinity.org/u/rbirkner)
#### Post date: [July 31, 2025, 12:21pm UTC](https://forum.dfinity.org/t/cors-issue-custom-header-being-blocked-by-ic-boundary-node/40097/24 "2025-07-31T12:21:31Z")
Hey @Gekctek,
Sorry for the delay. Unfortunately, I have a hard time finding an issue with the gateway (that doesn’t mean there isn’t one):
In general, `ic-gateway` does the following: it forwards the OPTIONS request to the canister. If the canister fails to reply, `ic-gateway` injects the default response. If the response is partially correct, `ic-gateway` only injects those headers that are not correct.
I tried to bypass `ic-gateway` to see what the response of your canister actually is for your sample request above:
```auto
curl -X OPTIONS \
-H "Access-Control-Request-Method: GET" \
-H "Access-Control-Request-Headers: atproto-accept-labelers" \
-v \
https://sctyd-5qaaa-aaaag-aa5lq-cai.icp0.io/xrpc/com.atproto.server.describeServer
```
To this end, I made the same call with `dfx`:
```auto
dfx canister call \
sctyd-5qaaa-aaaag-aa5lq-cai \
http_request \
--query \
--network https://icp-api.io \
--candid ./http_canister.did \
'(
record {
url = "/xrpc/com.atproto.server.describeServer";
method = "OPTIONS";
body = blob "";
headers = vec {
record { "Access-Control-Request-Headers"; "atproto-accept-labelers" };
record { "Access-Control-Request-Method"; "GET" };
};
certificate_version = null;
},
)'
```
And all I got as a response was a `404`:
```auto
(
record {
body = blob "";
headers = vec {};
upgrade = null;
status_code = 404 : nat16;
},
)
```
In that case, it is normal behavior that `ic-gateway` injects its own preflight response.
Maybe I made some mistake with the `curl` to `dfx` translation 😬 I am double-checking with the expert, just to make sure.
---
### Author:  [@Gekctek](https://forum.dfinity.org/u/Gekctek)
#### Post date: [August 7, 2025, 10:43pm UTC](https://forum.dfinity.org/t/cors-issue-custom-header-being-blocked-by-ic-boundary-node/40097/25 "2025-08-07T22:43:10Z")
Yep, Im not sure where I screwed up, but I did
There is a bug in my CORS preflight detection, so it wasn’t handling it properly and thus the 404
Thank you for looking into it
I confirmed its working on mainnet
[Previous page](https://forum.dfinity.org/t/cors-issue-custom-header-being-blocked-by-ic-boundary-node/40097.md?page=1)