CODEWITHSUNDEEP
httpheadercross-domaincors
Paul Draper
Paul Draper

Reputation: 83333

Default value for Access-Control-Allow-Methods

I just learned about the Access-Control-Allow-Methods header, e.g.

Access-Control-Allow-Methods: OPTIONS, HEAD, GET

I have never used this header (just Access-Control-Allow-Origin), but I have gotten CORS to work in the past.

Is the default to allow all methods, or have I gotten lucky with undefined behavior?

Upvotes: 54

Views: 90538

Answers (2)

monsur
monsur

Reputation: 47957

The Access-Control-Allow-Methods header indicates which HTTP methods are allowed on a particular endpoint for cross-origin requests. If you allow all HTTP methods, then its ok to set the value to something like Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD. However, if you want to limit the endpoint to only a few methods, you should only include those methods.

As to why you haven't been seeing this before, this header is only used on CORS preflight requests. Maybe your application didn't use CORS preflight, and then something changed to trigger a preflight. Does your application use any HTTP methods other than GET/POST, or any custom HTTP headers?

You can learn more about CORS preflight requests here: http://www.html5rocks.com/en/tutorials/cors/

Upvotes: 53

M Somerville
M Somerville

Reputation: 4610

The default of Access-Control-Allow-Methods is to allow through all simple methods, even on preflight requests. As the flow on https://www.w3.org/TR/cors/#preflight-request says (step 7 of successful preflight request):

If request method is not a case-sensitive match for any method in methods and is not a simple method, apply the cache and network error steps.

And the definition of simple method is:

A method is said to be a simple method if it is a case-sensitive match for one of the following: GET HEAD POST

So if you have a preflighted POST request (due to a custom HTTP header, say), and do not send a Access-Control-Allow-Methods response header, the request will still go ahead okay.

Upvotes: 15

Related Questions