A CORS preflight request is aCORS request that checks to see if the CORS protocol is understood and a server is aware using specific methods and headers.

It is anOPTIONS request, using two or three HTTP request headers:Access-Control-Request-Method,Origin, and optionallyAccess-Control-Request-Headers.

A preflight request is automatically issued by a browser and in normal cases, front-end developers don't need to craft such requests themselves. It appears when request is qualified as"to be preflighted" and omitted forsimple requests.

For example, a client might be asking a server if it would allow aDELETE request, before sending aDELETE request, by using a preflight request:

OPTIONS /resource/fooAccess-Control-Request-Method: DELETEAccess-Control-Request-Headers: x-requested-withOrigin: https://www.example.com

If the server allows it, then it will respond to the preflight request with anAccess-Control-Allow-Methods response header, which listsDELETE:

HTTP/1.1 204 No ContentConnection: keep-aliveAccess-Control-Allow-Origin: https://www.example.comAccess-Control-Allow-Methods: POST, GET, OPTIONS, DELETEAccess-Control-Allow-Headers: X-Requested-WithAccess-Control-Max-Age: 86400

The preflight response can be optionally cached for the requests created in the sameURL usingAccess-Control-Max-Age header like in the above example. To cache preflight responses, the browser uses a specific cache that is separate from the general HTTP cache that the browser manages. Preflight responses are never cached in the browser's general HTTP cache.

See also

• Related glossary terms:
  • CORS
• OPTIONS