What are preflight requests and how do they work?

A preflight request is an HTTP OPTIONS method request sent before the request itself to check if it is safe to send it.

Only when the server sends a positive response that the actual HTTP request is sent.

The preflight request contains metadata with information such as:

  • Origin: indicates the origin of the request (server name);

  • Access-Control-Request-Method: which HTTP methods will be used;

  • Access-Control-Request-Headers: keys that will be in the headers.

How it works

As described in the page about resource creation:

  • If you have implemented an OPTIONS method for the resource, the defined flow is followed, and the configured interceptor hierarchy is maintained.

  • If you have not implemented an OPTIONS method, interceptors configured in the all/all resource are ignored and not inherited by the resource.

As a standard, responses to preflight requests will contain the following headers:

key: value

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: HEAD, DELETE, POST, GET, OPTIONS, PUT, PATCH

If the preflight request contains the Access-Control-Request-Headers header, the response will include its content in the Access-Control-Allow-Headers key-value header.

Thanks for your feedback!
EDIT

Share your suggestions with us!
Click here and then [+ Submit idea]