Error Troubleshooting

Request header field dwt-md5 is not allowed by Access-Control-Allow-Headers in preflight response

Symptom

When uploading images, the request fails with this CORS error.

Cause

dwt-md5 is a built-in header Dynamic Web TWAIN uses to validate upload integrity. Because it’s non-standard, browsers send a preflight OPTIONS request to confirm the header is allowed. If your server doesn’t allow it, the upload fails.

Solution

Allow the dwt-md5 header in your server’s CORS configuration. For IIS, add:

<system.webServer>
    <httpProtocol>
        <customHeaders>
            <add name="Access-Control-Allow-Origin" value="*" />
            <add name="Access-Control-Allow-Methods" value="OPTIONS, POST, GET, PUT" />
            <add name="Access-Control-Allow-Headers" value="x-requested-with, dwt-md5" />
            <add name="Access-Control-Allow-Credentials" value="true" />
        </customHeaders>
    </httpProtocol>
</system.webServer>

Note

After updating the server configuration file, you’ll need to restart the server (i.e. IIS).

Check out more info here

Original post creation date: Dec 03, 2021

Last modified date: Jan 21, 2026