Method Not Allowed by CORS: Fix the Preflight Method

Browser message #

Typical wording varies by browser:

Method PUT is not allowed by Access-Control-Allow-Methods in preflight response.

What it means #

The preflight response does not permit the requested non-safelisted method. An HTTP Allow header is not a substitute for Access-Control-Allow-Methods.

Evidence to inspect #

Compare Access-Control-Request-Method on OPTIONS with Access-Control-Allow-Methods. Check for a proxy overriding the policy or an OPTIONS response from the wrong route.

Smallest safe fix #

Explicitly allow the methods the API supports for approved origins. Add PUT only if the endpoint genuinely supports PUT. Changing the CORS policy cannot create an application route.

Example permission for an approved request (not a complete API policy):

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT
Vary: Origin

Method names are case-sensitive. GET, HEAD, and POST are CORS-safelisted methods, but their headers or body content type can still require preflight. Explicit method lists avoid wildcard credential restrictions.

Verify the fix #

Confirm OPTIONS allows the intended method, then inspect the actual response. A subsequent 405 is an application routing problem even if CORS permits you to read it.

Use the CORS Tester to inspect public API headers or analyze a captured response. Confirm the result from the actual frontend afterward.

Continue learning #

Simple and preflighted requests · Framework configuration · All errors

References #

• MDN: method not allowed