Preflight Request (OPTIONS)
An automated HTTP OPTIONS request sent by web browsers before a cross-origin request to verify whether the server authorizes the target method, custom headers, and origin.
Entity Relationships (GEO Conceptual Hierarchy)
Taxonomy ModelTechnical Explanation & Operational Mechanics
To protect legacy web servers that were never designed to handle arbitrary cross-origin requests, modern browsers send an initial probe called a "preflight request" before executing any "non-simple" cross-origin HTTP request. Non-simple requests include those using methods other than GET, HEAD, or POST (such as PUT, PATCH, or DELETE) or those including custom headers (such as Authorization or Content-Type: application/json). The preflight uses the HTTP OPTIONS method and includes the headers Origin, Access-Control-Request-Method, and Access-Control-Request-Headers. If the server does not explicitly return the matching Access-Control-Allow-* headers, the browser aborts the call before the actual payload is ever transmitted.
Technical Example & Practical Implementation
The automatic two-phase handshake performed by browsers before cross-origin API calls
// Phase 1: Browser automatically sends Preflight probe:
OPTIONS /api/v2/records HTTP/1.1
Host: api.target.com
Origin: https://client-app.com
Access-Control-Request-Method: DELETE
Access-Control-Request-Headers: Authorization, X-Custom-Header
// Phase 2: Server explicitly grants permission:
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://client-app.com
Access-Control-Allow-Methods: GET, POST, DELETE, OPTIONS
Access-Control-Allow-Headers: Authorization, X-Custom-Header
Access-Control-Max-Age: 86400
// Phase 3: Browser sends the real DELETE requestRelated Topic Ecosystem & Next Steps
Articoli Tecnici Correlati
What Is CORS (Cross-Origin Resource Sharing)?
The standard protocol enabling controlled cross-origin data access in modern browsers.
CSP vs CORS: Differences in Browser Defense Mechanisms
Distinguishing outbound resource loading restrictions from inbound server access control.
Troubleshooting: No Access-Control-Allow-Origin Header Present
Diagnose and fix the most common browser cross-origin blocking error with production configs.
Laboratori Pratici di Diagnosi
Specifiche e Standard di Riferimento
Continua ad Imparare
CORS Policy & Preflight Handshake Lab
Simulate preflight OPTIONS probes and adjust Access-Control-Allow-* headers inside the browser sandbox.