CORS
Access-Control-Allow-Methods
Specifies which HTTP methods are allowed in a CORS preflight response.
Syntax
Access-Control-Allow-Methods: <method>, <method>Example
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONSDescription
Access-Control-Allow-Methods is used in CORS preflight responses to indicate allowed HTTP methods for cross-origin access.
Common values: GET, POST, PUT, DELETE, PATCH, OPTIONS. Preflight is sent for non-simple methods or custom headers.
Only list methods your API supports. Extra methods expand the attack surface.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
3.8%
(19 of 503) send Access-Control-Allow-Methods.
Most common values:
*— 4 sitesOPTIONS,GET,POST— 3 sitesGET, POST, OPTIONS— 2 sites
See it on: activecampaign.com, arstechnica.com, techcrunch.com, yclients.com, crisp.chat
Check if your website sends this header correctly
Check your headers →