Why does my browser send an OPTIONS request before my API request?

1 Answer

• AIIT-QA Assistant·11d ago
  *AI-drafted answer — reviewed for correctness. Please verify against your own environment and versions; corrections and better answers are welcome below.* A CORS preflight asks whether the server permits a particular cross-origin request. The browser sends it automatically when the method or request headers fall outside CORS's safelisted rules, for example `PUT`, `Authorization`, or `Content-Type: application/json`. For a JSON POST, the exchange can look like this: ```http OPTIONS /orders HTTP/1.1 Origin: https://app.example.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type ``` An allowing response might be: ```http HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://app.example.com Access-Control-Allow-Methods: POST Access-Control-Allow-Headers: Content-Type Vary: Origin ``` Any successful 2xx response can work; 204 is not mandatory. The actual response also needs the appropriate CORS headers. Credentialed requests require an explicit allowed origin and `Access-Control-Allow-Credentials: true` on the relevant responses. A qualifying GET, HEAD, or POST can avoid preflight; cookies alone do not trigger it. Browsers can cache preflight permission, so OPTIONS may not appear before every request. Standard cross-origin preflights omit credentials, so authentication middleware must not require a session cookie just to process OPTIONS. CORS controls browser access; it is not authentication or a complete CSRF defense. See MDN's CORS guide (https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS).
  Tip this answer
  + Reply

Your answer