Fix CORS Preflight OPTIONS Request Failures
A browser sends a preflight to ask whether a cross-origin request is allowed. Fix the OPTIONS exchange first; the browser will not send the real request when preflight fails.
Confirm what triggered preflight
In the browser network panel, inspect the OPTIONS request and the request it protects. Methods such as PUT, PATCH, and DELETE normally trigger preflight. So can JSON content types and headers such as Authorization or a custom request ID. The browser sends Origin, Access-Control-Request-Method, and possibly Access-Control-Request-Headers. Compare these exact values with the server policy.
Make OPTIONS reach a valid route
Ensure the CDN, gateway, reverse proxy, router, and application accept OPTIONS for the target path. A generic 404, 405, redirect, login page, or gateway error means CORS headers alone will not help. Handle preflight before normal authentication because the browser is asking whether the later request may carry credentials. Return a successful empty response promptly; no business operation should run.
Return the required allow headers
Access-Control-Allow-Origin must match the requesting origin allowed by policy. Access-Control-Allow-Methods must include the requested method, and Access-Control-Allow-Headers must permit every requested non-safelisted header. Header names are case-insensitive, but policy middleware and proxies can still be misconfigured. Do not add unnecessary origins, methods, or headers merely to silence the browser.
Handle credentials deliberately
When cookies or browser credentials are used, return an explicit allowed origin and Access-Control-Allow-Credentials: true. A wildcard origin cannot authorize a credentialed browser response. Add Vary: Origin when the response changes by origin so shared caches do not reuse one tenant's CORS decision for another.
Check redirects and proxy behavior
Canonical-host, HTTP-to-HTTPS, trailing-slash, and authentication redirects can break preflight or move it to a host with a different policy. Call the final HTTPS API URL directly. Verify that a CDN does not cache an OPTIONS response without the relevant origin and request-header dimensions. Confirm the proxy does not strip CORS request or response headers.
Reproduce the OPTIONS exchange
Send an OPTIONS request with the same Origin, requested method, and requested headers, then inspect every response header. After it succeeds, retry in a clean browser context. Use the HTTP Header Analyzer on copied non-secret headers and compare the application request with the cURL to Fetch converter.
Frequently Asked Questions
Why does the browser send OPTIONS?
It checks permission for a non-safelisted cross-origin request.
Should OPTIONS require a token?
Usually no; handle preflight before normal endpoint authentication.
Can wildcard origin be credentialed?
No. Credentialed requests require an explicit allowed origin.