How do I cache preflight responses?

Add Access-Control-Max-Age: 86400 (seconds) to the preflight response. This tells the browser to cache the preflight result for 24 hours, avoiding repeated OPTIONS requests for the same origin/method/headers combination.

Why does my API work from Postman but not the browser?

Postman is not a browser and does not enforce CORS or send preflight requests. CORS is a browser security feature. If your API works from Postman but not the browser, the issue is missing CORS headers on your server responses.

CORS Preflight Request Failed — OPTIONS Request Blocked or Missing Headers

Errorgeneral

About CORS Preflight Request Failed

Fix CORS preflight failures where the browser's OPTIONS request is blocked, returns wrong headers, or the server does not handle preflight correctly. This guide covers everything you need to know about this topic, including common causes, step-by-step solutions, and answers to frequently asked questions.

Here are the key things to understand: CORS preflight is an OPTIONS request sent before cross-origin requests that use custom headers or non-simple methods. The preflight checks if the server allows the actual request method, headers, and origin. Preflight is triggered by: custom headers, methods other than GET/POST/HEAD, non-simple content types. The server must respond to OPTIONS with Access-Control-Allow-Origin, -Methods, and -Headers. Preflight responses can be cached using Access-Control-Max-Age header to reduce overhead. Understanding these fundamentals will help you diagnose and resolve this issue more effectively.

The most common reasons this occurs include: Server does not handle OPTIONS method — returns 404, 405, or 500 instead of 200/204. Access-Control-Allow-Headers missing the custom header used in the actual request. Access-Control-Allow-Methods does not include the HTTP method of the actual request (PUT, DELETE, PATCH). Server-side authentication middleware rejecting the OPTIONS request that has no credentials. Identifying the root cause is the first step toward finding the right solution.

To resolve this, follow these recommended steps: Check the preflight response: DevTools > Network > filter by the request > find the OPTIONS request. Ensure the server handles OPTIONS explicitly: return 204 No Content with the correct CORS headers. Add all custom headers to Access-Control-Allow-Headers: Authorization, Content-Type, X-Custom-Header. Add all needed methods to Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS. Exclude OPTIONS requests from authentication middleware — preflight requests never include credentials. If these steps do not resolve the issue, consider consulting additional resources or a qualified professional.

This article is part of our Browser Errors collection on Error Codes Wiki. We provide comprehensive, up-to-date information to help you find solutions quickly.

Quick Answer

When does the browser send a preflight?

For cross-origin requests that use: non-simple methods (PUT, DELETE, PATCH), custom headers (Authorization, X-*), or content types other than application/x-www-form-urlencoded, multipart/form-data, or text/plain.

Overview

Fix CORS preflight failures where the browser's OPTIONS request is blocked, returns wrong headers, or the server does not handle preflight correctly.

Key Details

CORS preflight is an OPTIONS request sent before cross-origin requests that use custom headers or non-simple methods
The preflight checks if the server allows the actual request method, headers, and origin
Preflight is triggered by: custom headers, methods other than GET/POST/HEAD, non-simple content types
The server must respond to OPTIONS with Access-Control-Allow-Origin, -Methods, and -Headers
Preflight responses can be cached using Access-Control-Max-Age header to reduce overhead

Common Causes

Server does not handle OPTIONS method — returns 404, 405, or 500 instead of 200/204
Access-Control-Allow-Headers missing the custom header used in the actual request
Access-Control-Allow-Methods does not include the HTTP method of the actual request (PUT, DELETE, PATCH)
Server-side authentication middleware rejecting the OPTIONS request that has no credentials

Steps

1Check the preflight response: DevTools > Network > filter by the request > find the OPTIONS request
2Ensure the server handles OPTIONS explicitly: return 204 No Content with the correct CORS headers
3Add all custom headers to Access-Control-Allow-Headers: Authorization, Content-Type, X-Custom-Header
4Add all needed methods to Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
5Exclude OPTIONS requests from authentication middleware — preflight requests never include credentials