Access-Control-Allow-Methods
ResponseActiveAccess-Control-Allow-Methods is returned in CORS preflight responses (OPTIONS requests) to tell the browser which HTTP methods are allowed for cross-origin requests. It is only sent in response to a preflight – not on actual requests. The browser checks this before sending the real request.
Access-Control-Allow-Methods: <method>[, <method>]*
Description
When a browser sends a CORS preflight OPTIONS request (triggered by non-simple methods like PUT, DELETE, or PATCH), the server responds with Access-Control-Allow-Methods listing which methods are permitted. Simple methods (GET, POST, HEAD) don't require preflight. The Access-Control-Max-Age header caches the preflight result to avoid repeated OPTIONS round-trips.
Directives
| Directive | Description |
|---|---|
| Access-Control-Max-Age | Seconds to cache the preflight response. Default varies by browser (5s Chrome, 86400 Firefox max). |
| Access-Control-Allow-Headers | Which request headers are allowed for cross-origin requests. |
| Access-Control-Allow-Credentials | Whether the response can be read when credentials are included. Must be true (not *). |
Examples
REST API preflight
http
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400Simple CORS (no preflight)
http
# GET/POST/HEAD with safe headers don't trigger preflight
# The browser sends the request directly