Preflight (OPTIONS)

When a cross-origin request is not “simple” (for example a custom header, or certain methods), browsers first send an OPTIONS preflight asking permission.

Request side

• Origin
• Access-Control-Request-Method — the method the actual request will use
• Access-Control-Request-Headers — non-simple headers the actual request will send

Response side

• Access-Control-Allow-Origin
• Access-Control-Allow-Methods
• Access-Control-Allow-Headers
• Access-Control-Max-Age — optional preflight cache hint
• Access-Control-Allow-Credentials when cookies/auth are involved

CORSProbe can send a simulated OPTIONS with those request headers and explain whether the Allow-* answers match.

Probe with preflight