Error: Failed to make XHR request [0x80070057] Request header field [my-header] is not allowed by Access-Control-Allow-Headers in preflight response

[Tr59]

Provide required information needed to triage your issue

Unexpected Runtime [Error] [Log] Error: Failed to make XHR request [0x80070057] Request header field [my-header] is not allowed by Access-Control-Allow-Headers in preflight response

Your Environment

• Platform [PC desktop, Mac, iOS, Office on the web]: PC desktop
• Host [Excel, Word, PowerPoint, etc.]: Outlook
• Office version number: 2403 build 17425.20176
• Operating System: Windows 11

Expected behavior

The XmlHttpRequest should complete successfully when triggered by the "OnMessageSend" event.

Current behavior

The preflight request doesn't seem to take the server's return and the POST request gives an error:
"Error: Failed to make XHR request [0x80070057] Request header field [my-header] is not allowed by Access-Control-Allow-Headers in preflight response 0"

Steps to reproduce

1. Create an XMLHttpRequest in OnMessageSend
2. Open a POST request to 'https://www.my-domain.fr/the/path/to/endpoint'
3. send request

Useful logs

For debugging I'm on localhost but I have exactly the same problem on my integration and production environments.

In manifest.xml :

 <AppDomains>
    <AppDomain>https://localhost:4200</AppDomain>
  </AppDomains>

microsoft-officeaddins-allowed.json :

{
  "allowed": [
    "https://localhost:4200/index.html",
    "https://localhost:4200/assets/events.js",
    "https://localhost:4200/assets/commands.html"
  ]
}

Outlook logs :

16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] 'requete : POST', 'https://www.my-domain.fr/the/path/to/endpoint'		
16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] headers value : 		
16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] my-header: ABC
16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] my-header-two: ABCDEF		
16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] my-header-three: 123-abd		
16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] content-type: multipart/form-data; boundary=----WebKitFormBoundarye6c6k0fo08g		
16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] accept: */*	
16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] { isTrusted: false }		
16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] [Error: Failed to make XHR request [0x80070057] Request header field [my-header] is not allowed by Access-Control-Allow-Headers in preflight response 0]		
16/04/2024 08:48:13	Verbose	Runtime	[Console] [Log] LaunchEventObj.completed was invoked: 5		
16/04/2024 08:48:13	Unexpected	Runtime	[Error] [Log] Error: Failed to make XHR request [0x80070057] Request header field [my-header] is not allowed by Access-Control-Allow-Headers in preflight response 0
xhr.onerror
l.dispatchEvent
foundation.win32.bundle:86:5675
l.value
foundation.win32.bundle:79:9076
l.value
foundation.win32.bundle:79:5017
<unknown>
    at foundation.win32.bundle:79:7803
l.value
foundation.win32.bundle:94:675
t.value
foundation.win32.bundle:35:3855
<unknown>
    at foundation.win32.bundle:35:661
t.value
foundation.win32.bundle:35:2509
t.value
foundation.win32.bundle:35:639

Server logs :

[] INFO  2024-04-16 07:57:21.647 - OPTIONS
https://www.my-domain.fr/the/path/to/endpoint
[] INFO  2024-04-16 07:57:21.647 - log headers :
[] INFO  2024-04-16 07:57:21.647 - access-control-request-method: [POST]
[] INFO  2024-04-16 07:57:21.647 - accept-encoding: [gzip, deflate]
[] INFO  2024-04-16 07:57:21.647 - origin: [https://localhost:4200/]
[] INFO  2024-04-16 07:57:21.647 - access-control-request-headers: [my-header, my-header-two, accept, my-header-three, Content-Length, Content-Type]
[] INFO  2024-04-16 07:57:21.647 - sec-fetch-mode: [CORS]
[] INFO  2024-04-16 07:57:21.647 - accept: [*/*]
[] INFO  2024-04-16 07:57:21.647 - user-agent: [Microsoft Office/16.0 (Windows NT 10.0;  16.0.17425; Pro)]
[] INFO  2024-04-16 07:57:21.647 - host: [www.my-domain.fr]
[] INFO  2024-04-16 07:57:21.647 - content-length: [0]
[] INFO  2024-04-16 07:57:21.647 - connection: [Keep-Alive]
[] INFO  2024-04-16 07:57:21.647 - cache-control: [no-cache]

[] INFO  2024-04-16 07:57:21.647 - log response headers :
[] INFO  2024-04-16 07:57:21.647 - Access-Control-Allow-Credentials: [true]
[] INFO  2024-04-16 07:57:21.647 - Access-Control-Allow-Methods: [GET, POST, PUT, DELETE, OPTIONS]
[] INFO  2024-04-16 07:57:21.647 - Access-Control-Allow-Headers: [my-header, Authorization, my-header-two, my-header-three, Content-Type, Access-Control-Allow-Headers]

Thank you for taking the time to report an issue. Our triage team will respond to you in less than 72 hours. Normally, response time is <10 hours Monday through Friday. We do not triage on weekends.

[Tr59]

As additionnal information we do send "Access-Control-Allow-Origin", "*"" in the response header. It is not in the log file because i made a mistake when i pasted the log file content

Thanks

[Tr59]

Here is a copy of the request captured by Fiddler

[ndeleuze]

@Tr59 was this POST request successful at some point and it is no longer working?

[Tr59]

This request worked until February.
Following an Office update earlier this week, the problem is no longer present.

Version 2404 (build 17531.20120 Office)