Placing the 'corsheaders.middleware.CorsMiddleware'above other middleware configurations fixed it for me. Placing the 'corsheaders.middleware.CorsMiddleware'just below the security middleware ensures corsHeaders are added to responses before they reach other middleware