Default value for Access-Control-Allow-Methods

http header cross-domain cors
Paul Draper picture Paul Draper · Dec 9, 2013 · Viewed 59.9k times · Source

I just learned about the Access-Control-Allow-Methods header, e.g.

Access-Control-Allow-Methods: OPTIONS, HEAD, GET

I have never used this header (just Access-Control-Allow-Origin), but I have gotten CORS to work in the past.

Is the default to allow all methods, or have I gotten lucky with undefined behavior?

Answer

monsur picture monsur · Dec 9, 2013

Just to clarify, Access-Control-Request-Method is a request header that is set by the browser on CORS preflight requests, and it can only have one value. The Access-Control-Allow-Methods header is a CORS response header, and it can have multiple values. I assume you are asking about Access-Control-Allow-Methods because this is the value the server specifies.

The Access-Control-Allow-Methods header indicates which HTTP methods are allowed on a particular endpoint for cross-origin requests. If you allow all HTTP methods, then its ok to set the value to something like Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD. However, if you want to limit the endpoint to only a few methods, you should only include those methods.

As to why you haven't been seeing this before, this header is only used on CORS preflight requests. It could be that your application didn't use CORS preflight, and then something changed to trigger a preflight. Does you application use any HTTP methods other than GET/POST, or any custom HTTP headers?

You can learn more about CORS preflight requests here: http://www.html5rocks.com/en/tutorials/cors/

Related questions

HTTP headers in Websockets client API

Looks like it's easy to add custom HTTP headers to your websocket client with any HTTP header client which supports this, but I can't find how to do it with the JSON API. Yet, it seems that there should be …

Read More
Custom HTTP Authorization Header

I was wondering if it's acceptable to put custom data in an HTTP authorization header. We're designing a RESTful API and we may need a way to specify a custom method of authorization. As an example, let's call it FIRE-TOKEN …

Read More
How do I set headers using python's urllib?

I am pretty new to python's urllib. What I need to do is set a custom header for the request being sent to the server. Specifically, I need to set the Content-type and Authorizations headers. I have looked into the …

Read More