◆Error Codes Wiki

CORS Preflight Errors — Access-Control-Allow-Origin Troubleshooting Guide

Error4xx client error

Overview

Complete guide to fixing CORS preflight request failures including Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers errors.

Key Details

  • CORS (Cross-Origin Resource Sharing) preflight uses an OPTIONS request before the actual request
  • Preflight is triggered by non-simple requests: custom headers, PUT/DELETE methods, or non-standard Content-Type
  • The server must respond to OPTIONS with appropriate Access-Control-Allow-* headers
  • A failed preflight blocks the actual request entirely — no data is sent or received
  • CORS is enforced by browsers only — server-to-server requests are not affected

Common Causes

  • Server not handling OPTIONS requests or returning incorrect Access-Control headers
  • Access-Control-Allow-Origin missing or not matching the requesting origin
  • Required custom headers not listed in Access-Control-Allow-Headers
  • Access-Control-Allow-Methods not including the HTTP method being used (PUT, DELETE, PATCH)
  • Credentials mode enabled but Access-Control-Allow-Origin set to wildcard (*)

Steps

  1. 1Check the browser console for the specific CORS error message — it tells you exactly what is missing
  2. 2On the server, add Access-Control-Allow-Origin with the specific origin or * for public APIs
  3. 3Add Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS to the server response
  4. 4Add Access-Control-Allow-Headers listing all custom headers your client sends
  5. 5If using credentials (cookies), set Access-Control-Allow-Credentials: true and use a specific origin (not *)
  6. 6Add Access-Control-Max-Age: 86400 to cache preflight results and reduce OPTIONS requests

Tags

corspreflightaccess-controlcross-originoptions-request

Related Items

browser-cors-errorbrowser-cors-error-explainedbrowser-mixed-content

More in 4xx Client Error

http-400-bad-requestHTTP 400 Bad Request — What It Means & How to Fix It
Error
http-401-unauthorizedHTTP 401 Unauthorized — What It Means & How to Fix It
Error
http-402-payment-requiredHTTP 402 Payment Required — What It Means & How to Fix It
Error
http-403-forbiddenHTTP 403 Forbidden — What It Means & How to Fix It
Error
http-404-not-foundHTTP 404 Not Found — What It Means & How to Fix It
Error
http-405-method-not-allowedHTTP 405 Method Not Allowed — What It Means & How to Fix It
Error

Frequently Asked Questions

CORS is a browser security policy. Server-to-server HTTP requests, cURL, and Postman do not enforce CORS because they are not executing potentially malicious JavaScript.