How to handle an invalid CORS preflight request?

cors preflight
todofixthis picture todofixthis · Nov 16, 2015 · Viewed 7k times · Source

Suppose a CORS preflight request comes in, but it specifies an unsupported value for one or more Access-Control-Request-* headers. How should the server communicate this back to the browser?

Some examples:

  • The browser sends a preflight request with Access-Control-Request-Method: PUT, but the server doesn't allow PUT requests for the specified resource.
  • The browser sends a preflight request with Access-Control-Request-Headers: X-PINGOTHER, but the server doesn't allow/understand that header.

The only clue I could find was located in the W3C documentation, which indicates that the server should "terminate this request" if there is a problem with the preflighted response, but I'm not sure what that looks like in practice (is the server really supposed to terminate the connection without sending back a response??).

Or, does the server not need to bother with validation at all, since the browser will know it did something wrong just by checking the Access-Control-Allow-* response headers?

Answer

todofixthis picture todofixthis · Nov 19, 2015

Tomcat's CORS Filter returns a 403 response when an invalid CORS preflight request is received:

If request is invalid, or is not permitted, then request is rejected with HTTP status code 403 (Forbidden). A flowchart that demonstrates request processing by this filter is available.

Granted, the documentation doesn't explain why it does this, but at least it serves as a starting point.

Related questions

No 'Access-Control-Allow-Origin' header is present on the requested resource—when trying to get data from a REST API

I'm trying to fetch some data from the REST API of HP Alm. It works pretty well with a small curl script - I get my data. Now doing that with JavaScript, fetch and ES6 (more or less) seems to …

Read More
Why is an OPTIONS request sent and can I disable it?

I am building a web API. I found whenever I use Chrome to POST, GET to my API, there is always an OPTIONS request sent before the real request, which is quite annoying. Currently I get the server to ignore …

Read More
AngularJS performs an OPTIONS HTTP request for a cross-origin resource

I'm trying to setup AngularJS to communicate with a cross-origin resource where the asset host which delivers my template files is on a different domain and therefore the XHR request that angular performs must be cross-domain. I've added the appropriate …

Read More