CORS Preflight Request

A CORS preflight is an HTTP OPTIONS request that the browser sends automatically before certain cross-origin requests. It asks the target server whether the real request, with its method and headers, is permitted from the calling origin.

Why it matters

Preflights happen for requests that are not "simple": methods such as PUT or DELETE, a Content-Type of application/json, or custom headers like Authorization. If the server does not answer the OPTIONS request with the right headers and a 2xx status, the browser blocks the real request and the console shows an error such as "Response to preflight request doesn't pass access control check".

A frequent surprise is that the API works in curl and fails in the browser, because curl never enforces CORS.

Example

OPTIONS /v1/items HTTP/1.1
Origin: https://app.example.com
Access-Control-Request-Method: PUT
Access-Control-Request-Headers: authorization, content-type

A passing response:

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, PUT, DELETE
Access-Control-Allow-Headers: authorization, content-type
Access-Control-Max-Age: 600

Common mistakes

• Handling OPTIONS behind authentication, so it returns 401 or 403.
• Using * for allowed origin together with credentials, which browsers reject.
• Omitting Access-Control-Max-Age, causing a preflight on every call.

Related

• CORS
• Same-origin policy
• HTTP status code
• टूल: CORS checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.