Access-Control-Request-Method: the preflight question
Access-Control-Request-Method is sent by the browser on a preflight OPTIONS request to ask whether the method it is about to use is permitted.
At a glance
- Direction
- Request only, on the preflight, and set by the browser.
- Defined in
- The Fetch standard (WHATWG)
- When absent
- The OPTIONS request is not a preflight, and CORS logic does not apply to it.
- Value
- Exactly one method name, in upper case
- Triggered by
- Any method other than GET, HEAD, or a POST with a safelisted content type
- Answered by
- Access-Control-Allow-Methods on the preflight response
- Not settable by
- Page code. It is on the forbidden header list.
In detail
This header is what makes an OPTIONS request a preflight rather than an ordinary one. The browser is asking permission in advance, before sending anything that could change state, and it names one method per preflight. A handler that answers OPTIONS generically without reading this header is not doing CORS, it is just replying.
Only unsafe requests trigger the question. GET and HEAD never do, and neither does a POST whose content type is one of the safelisted form or text types, which is why an ordinary HTML form can post across origins with no preflight while a JSON POST from the same page cannot.
The server must answer with a list that contains this exact method, compared case sensitively. That is the whole check: no origin comparison happens here, and no body is involved. If the method is not in the list, the browser stops and the real request is never made, so nothing reaches your handler at all.
You can reproduce a preflight by hand with any client that sends an OPTIONS request with this header set, which is the quickest way to separate a CORS problem from an application problem. If the preflight answers correctly on the command line but fails in the browser, the difference is usually credentials or a header your allow list omits.
Examples
OPTIONS /api/items/7 HTTP/1.1
Host: api.example.com
Origin: https://app.example.com
Access-Control-Request-Method: DELETEcurl -i -X OPTIONS https://api.example.com/api/items/7 \
-H 'Origin: https://app.example.com' \
-H 'Access-Control-Request-Method: DELETE'You want a 200 or 204 whose Access-Control-Allow-Methods list contains DELETE.
Things that catch people out
- Answering every OPTIONS request with 200 and no CORS headers still fails the preflight, because the browser needs the allow list rather than a successful status.
- Method comparison is case sensitive, so answering with Delete instead of DELETE fails a check that otherwise looks correct.
- Some gateways strip this header or handle OPTIONS themselves, which produces preflight failures that never reach the application logs.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Access-Control-Allow-Methods: permitted methods on preflight
Where the allow methods header belongs, why it appears only on the preflight response, which methods never need it, and how it interacts with caching.
Access-Control-Request-Headers: declaring custom headers
What the browser declares on a preflight, why the names arrive lowercase and sorted, which headers are omitted, and how to answer without guessing.
Access-Control-Max-Age: caching the preflight result
How long a browser may reuse a preflight result, the caps Chrome and Firefox apply, what minus one means, and why a doubled request count is normal.
Origin: where a request was initiated from
When browsers send Origin, why it is only scheme, host and port, when the value is null, and how to use it for cross-site request forgery defence.
Timing-Allow-Origin: exposing detailed resource timings
Why cross-origin resources show zeroed timings, what Timing-Allow-Origin unlocks in the Resource Timing API, and how it differs from a CORS allow header.
Authorization: credentials on a request
How the Authorization header is structured, how Basic and Bearer differ, why it is dropped across a cross-host redirect, and how it interacts with caching.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL