FXM CORS Sends OPTIONS request and 405s

Question

I'm attempting to add a Coveo searchbox to another site using FXM. The Searchbox in question works fine locally on the Sitecore Server. It searching terms properly. It has type-ahead/query suggestion/auto complete (whatever you want to call it) just fine. Locally, it just sends a POST requests for the type-ahead calls and everything works.

On the site where it's embedded using FXM, everything works (including being sent to the proper search page) EXCEPT for the type-ahead feature. It first sends an OPTIONS request which produces a 405 and then on the POST request it provides the following error message:

Access to XMLHttpRequest at 
'<sitecore domain>/coveo/rest/v2/querySuggest?sitecoreItemUri=sitecore%3A%2F%2Fweb%2F%7B89716DAE-9BF3-4EEE-9704-1E10E0AD8051%7D%3Flang%3Den%26amp%3Bver%3D1&siteName=<FXM Site Name>&authentication' 
from origin '<FXM Site Url>' has been blocked by CORS policy: Response to 
preflight request doesn't pass access control check: It does not have HTTP ok status.

Based on various blog posts and a bit of conversation from Slack, I updated the /Coveo/Rest/web.config file with the following lines:

<httpProtocol>
 <customHeaders>
   <add name="Access-Control-Allow-Origin" value="https://www.fxmsite.com" />
   <add name="Access-Control-Allow-Credentials" value="true" />
   <add name="Access-Control-Allow-Methods" value="GET,POST,PATCH,PUT,DELETE,OPTIONS" />
   <add name="Access-Control-Allow-Headers" value="Accept, Origin, Content-Type, X-Auth-Token, Access-Control-Allow-Headers, Authorization" />
   <remove name="Allow" />
   <add name="Allow" value="GET,POST,PATCH,PUT,DELETE,OPTIONS" />
 </customHeaders>
</httpProtocol>

This got me past many errors but not this current one.

Has anyone experienced this in the past and got through it? Anyone have any ideas?

Answer 1

So I did not find an outright "fix", however, I do have a workaround that enables this to work.

In addition to the above httpProtocol section I posted in the description in the specific web.config file, I also created my own HttpHandler just for OPTIONS requests that come in.

public class CoveoOptionsHandler : IHttpHandler
{
    public bool IsReusable { get { return true; } }

    public void ProcessRequest(HttpContext ctx)
    {
        ctx.Response.StatusCode = 200;
        ctx.Response.End();

    }
}

Once this handler was added above Coveo's handler in the same web.config file using the following line it would catch the OPTIONS requests and respond properly because of the CustomHeaders defined as well.

<add name="CoveoOptionsHandler" path="*" verb="OPTIONS" type="Your.AssemblyNamespace.Here.CoveoOptionsHandler, Your.Assembly.Here" />

After that is was in place, the POST request used for QuerySuggestions would come through just fine.