CORS Preflight

A browser sends an OPTIONS preflight before a cross-origin request that needs permission.

Respond to Access-Control-Request-Method and Access-Control-Request-Headers with the allowed origin, methods, and headers. Cache the result with Access-Control-Max-Age when appropriate.

httpcorsbrowserpreflight

Reference (http)

OPTIONS /api/data HTTP/1.1
Origin: https://app.example.com
Access-Control-Request-Method: PUT
Access-Control-Request-Headers: Authorization, Content-Type

Respond to Access-Control-Request-Method and Access-Control-Request-Headers with the allowed origin, methods, and headers. Cache the result with Access-Control-Max-Age when appropriate.

Common mistakes

Returning Access-Control-Allow-Origin without answering the requested method or headers.

Sources

MDN HTTP Reference
MDN CORS Guide