Search code examples
corspreflight

How can I identify a CORS preflight request?

A CORS preflight request obviously uses the OPTIONS method and has an Origin header. However, a browser can decide for any HTTP request to add an Origin header. Also, OPTIONS may be used for other functionality than CORS. (How) Can I identify exactly (without false positives or negatives) whether a request is a CORS preflight request?

Solution

  • Check for the Access-Control-Request-Method header. It would not make much sense to send it in a request other than the preflight request.