Access-Control-Allow-Methods
response headercors
Lists the HTTP methods a cross-origin request may use, in the response to a CORS preflight.
Before sending a cross-origin request that isn't 'simple' — a PUT, PATCH or DELETE, a JSON body, or a custom header — the browser sends an OPTIONS preflight asking for permission. The response's Access-Control-Allow-Methods says which methods are allowed. GET, HEAD and POST are always allowed, so they never need listing.
Syntax
Access-Control-Allow-Methods: <method>, <method>…
Defined in Fetch Standard — CORS protocol.
Examples
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
a typical REST API
Access-Control-Allow-Methods: *
any method — only for requests without credentials
Good to know
- Only the preflight (OPTIONS) response needs this header.
- The OPTIONS response must succeed with a 2xx status — a 404 or 405 from your router fails the preflight, whatever the headers say.
- Cache preflight results with
Access-Control-Max-Age: 600(seconds) to save a round trip on every request.
Further reading: CORS errors explained
How to set Access-Control-Allow-Methods
res.set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE");module.exports = {
async headers() {
return [
{
source: "/(.*)",
headers: [{ key: "Access-Control-Allow-Methods", value: "GET, POST, PUT, PATCH, DELETE" }],
},
];
},
};add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE" always;
Header always set Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE"
Check it
Fetch only the response headers and filter for Access-Control-Allow-Methods. In the browser, it's under Response Headers in DevTools → Network.
curl -sI https://example.com/ | grep -i '^access-control-allow-methods:'
To compare response headers across many URLs at once, use the HTTP Status Checker.
Frequently asked questions
Why is the browser sending an OPTIONS request I never wrote?
That's the CORS preflight. It happens for methods other than GET, HEAD and POST, for Content-Type values other than form or plain text, and for custom headers such as Authorization.