Access-Control-Allow-Methods Header: Syntax and Examples

How Access-Control-Allow-Methods works

Before a cross-origin PUT, PATCH or DELETE (or a POST with a JSON body), the browser sends an OPTIONS preflight with Access-Control-Request-Method. The server’s answer must list that method here. GET, HEAD and POST are always allowed and never need listing.

Examples

Preflight response

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400

Common mistakes

A preflight that fails authentication (401) or hits a redirect fails the whole request. Let OPTIONS requests through without auth.

Check it

curl -sI https://example.com | grep -i '^access-control-allow-methods:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

Access-Control-Allow-Headers: lists the request headers a cross-origin request may send, in answer to a preflight.
Access-Control-Max-Age: says how many seconds a browser may cache a preflight result.
Access-Control-Allow-Origin: tells the browser which origin may read a cross-origin response.

More cors headers

Access-Control-Allow-Credentials , Access-Control-Expose-Headers , Origin .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Access-Control-Allow-Methods header do?

The Access-Control-Allow-Methods response header lists the HTTP methods allowed for a cross-origin request, in answer to a preflight. Before a cross-origin PUT, PATCH or DELETE (or a POST with a JSON body), the browser sends an OPTIONS preflight with Access-Control-Request-Method. The server’s answer must list that method here. GET, HEAD and POST are always allowed and never need listing.

How do I see the Access-Control-Allow-Methods header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.