OPTIONSActive
OPTIONS describes the communication options for the target resource. Browsers send OPTIONS automatically as a CORS preflight request before cross-origin requests with non-simple methods or headers, checking what the server permits.
Properties
| Safe | Yes | Safe methods don't change server state. They are read-only. |
| Idempotent | Yes | Idempotent methods produce the same result if called once or multiple times. |
| Cacheable | No | Cacheable responses may be stored and reused for equivalent requests. |
| Request Body | No | Whether a request body is allowed / expected. |
| Response Body | Yes | Whether a response body is expected. |
Description
The OPTIONS method requests information about the communication options available for the target resource. It is commonly used as a CORS preflight request – browsers send OPTIONS to check whether a cross-origin request is permitted before sending the actual request.
Examples
CORS preflight
http
OPTIONS /api/users HTTP/1.1
Host: api.example.com
Origin: https://app.example.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: Content-Type, AuthorizationPreflight response
http
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400