Learn CORSErrorsTesterFrameworksQuizSearch

CORS Preflight Request Failed: Inspect OPTIONS First

By Ankit Jain · Updated

Diagnose failing OPTIONS requests by checking HTTP status, redirects, origin permission, methods and request headers.

Browser message

Typical wording varies by browser:

Response to preflight request does not pass access control check.

What it means

The browser did not receive a valid permission response to its OPTIONS probe. A required preflight failure prevents the actual request from being sent.

Evidence to inspect

In Network, open OPTIONS for the exact API URL. Check its status, redirects, Origin, Access-Control-Request-Method, and Access-Control-Request-Headers. Common causes include an authentication filter, missing OPTIONS route, gateway failure, or rejected header.

Smallest safe fix

Handle OPTIONS before authentication that expects session cookies. A CORS preflight does not carry those cookies. Return a 2xx status and permissions for the approved origin, intended method, and requested non-safelisted headers. Keep authentication on the actual endpoint.

Example permission for an approved request (not a complete API policy):

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: PUT
Access-Control-Allow-Headers: Content-Type, Authorization
Vary: Origin

For credentials mode include, also return Access-Control-Allow-Credentials: true and an exact approved origin. OPTIONS permission does not replace the actual response’s origin permission.

Verify the fix

Use a fresh browser context or wait for cached preflight permission to expire. Confirm OPTIONS succeeds, the actual request is sent, and its response independently permits access.

Use the CORS Tester to inspect public API headers or analyze a captured response. Confirm the result from the actual frontend afterward.

Continue learning

Preflight step by step · Framework configuration · All errors

References