A CORS preflight request is a CORS request that checks to see if the {{Glossary("CORS")}} protocol is understood.
It is an {{HTTPMethod("OPTIONS")}} request using two HTTP request headers: {{HTTPHeader("Access-Control-Request-Method")}} and {{HTTPHeader("Access-Control-Request-Headers")}}, and the {{HTTPHeader("Origin")}} header.
For example, a client might be asking a server if it would allow a {{HTTPMethod("DELETE")}} request, before actually sending a DELETE
request by using a preflight request:
OPTIONS /resource/foo Access-Control-Request-Method: DELETE Access-Control-Request-Headers: origin, x-requested-with Origin: https://foo.bar.org
If the server allows it, then it will respond to the preflight request with a {{HTTPHeader("Access-Control-Allow-Methods")}} response header that lists DELETE
:
HTTP/1.1 200 OK Content-Length: 0 Connection: keep-alive Access-Control-Allow-Origin: https://foo.bar.org Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Access-Control-Max-Age: 86400
See also
- CORS
- {{HTTPMethod("OPTIONS")}}