Error Codes Wiki

CORS Preflight Request Failed — OPTIONS Request Blocked or Missing Headers

Errorgeneral

Overview

Fix CORS preflight failures where the browser's OPTIONS request is blocked, returns wrong headers, or the server does not handle preflight correctly.

Key Details

  • CORS preflight is an OPTIONS request sent before cross-origin requests that use custom headers or non-simple methods
  • The preflight checks if the server allows the actual request method, headers, and origin
  • Preflight is triggered by: custom headers, methods other than GET/POST/HEAD, non-simple content types
  • The server must respond to OPTIONS with Access-Control-Allow-Origin, -Methods, and -Headers
  • Preflight responses can be cached using Access-Control-Max-Age header to reduce overhead

Common Causes

  • Server does not handle OPTIONS method — returns 404, 405, or 500 instead of 200/204
  • Access-Control-Allow-Headers missing the custom header used in the actual request
  • Access-Control-Allow-Methods does not include the HTTP method of the actual request (PUT, DELETE, PATCH)
  • Server-side authentication middleware rejecting the OPTIONS request that has no credentials

Steps

  1. 1Check the preflight response: DevTools > Network > filter by the request > find the OPTIONS request
  2. 2Ensure the server handles OPTIONS explicitly: return 204 No Content with the correct CORS headers
  3. 3Add all custom headers to Access-Control-Allow-Headers: Authorization, Content-Type, X-Custom-Header
  4. 4Add all needed methods to Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
  5. 5Exclude OPTIONS requests from authentication middleware — preflight requests never include credentials

Tags

corspreflightoptionscross-originheaders

Related Items

More in General

Frequently Asked Questions

For cross-origin requests that use: non-simple methods (PUT, DELETE, PATCH), custom headers (Authorization, X-*), or content types other than application/x-www-form-urlencoded, multipart/form-data, or text/plain.