Access-Control-Allow-Methods — Specifying Permitted HTTP Methods in CORS

In this tutorial, you will learn about Access. We cover key concepts, practical examples, and best practices to help you master this topic.

The Access-Control-Allow-Methods response header tells the browser which HTTP methods the server permits for cross-origin requests, validating the method requested in the preflight Access-Control-Request-Method header.

What You'll Learn

• How Access-Control-Allow-Methods is used in preflight responses
• Best practices for method whitelisting
• Wildcard usage and method negotiation

Why It Matters

Restricting methods to only what your API supports reduces attack surface. Every method in Allow-Methods is effectively advertised as available. DodaTech's API Gateway uses this header to enforce method-level access control across Microservices.

flowchart LR
    A["Browser sends OPTIONS"] --> B["Request-Method: DELETE"]
    B --> C{"Server checks Allow-Methods"}
    C -->|"DELETE is listed"| D["Preflight succeeds"]
    C -->|"DELETE not listed"| E["Preflight fails"]
    D --> F["Browser sends DELETE"]
    F --> G["Request proceeds normally"]
    style D fill:#86efac,stroke:#16a34a
    style E fill:#fecaca,stroke:#dc2626

Code Examples

// JavaScript triggers the method check automatically
// The browser checks Allow-Methods before sending the actual request
async function deleteResource(id) {
  try {
    const response = await fetch(`https://api.example.com/resource/${id}`, {
      method: 'DELETE'
    });
    // Browser already validated DELETE is allowed
    return response.json();
  } catch (err) {
    console.error('DELETE not allowed by CORS');
  }
}

# Configuring methods per route in Flask
@app.route('/api/resource/<id>', methods=['GET', 'PUT', 'DELETE'])
def handle_resource(id):
    response = jsonify({"id": id})
    origin = request.headers.get('Origin', '')
    if origin in ALLOWED_ORIGINS:
        response.headers['Access-Control-Allow-Origin'] = origin
        response.headers['Access-Control-Allow-Methods'] = \
            'GET, PUT, DELETE, OPTIONS'
        response.headers['Vary'] = 'Origin'
    return response

# Simulate a preflight with DELETE method
curl -X OPTIONS https://api.example.com/resource/1 \
  -H "Origin: https://app.example.com" \
  -H "Access-Control-Request-Method: DELETE" \
  -I 2>&1 | grep "allow-methods"

Common Mistakes

1. Not Including OPTIONS in Allow-Methods

Preflight uses OPTIONS. It must be in Allow-Methods for preflight to succeed.

2. Listing Methods That Do Not Exist on the Endpoint

Clients may attempt methods listed in Allow-Methods and receive 405 errors.

3. Using Wildcard * with Credentials

Like Allow-Origin, the wildcard for methods cannot be used with Allow-Credentials: true.

4. Forgetting That Method Names Are Case-Sensitive

Allow-Methods expects uppercase method names. Lowercase values may not be recognized.

5. Listing Deprecated Methods

Methods like TRACE or CONNECT should never appear in Allow-Methods for security reasons.

Practice Questions

1. What header does the browser send to indicate the desired method?
2. Can Access-Control-Allow-Methods use wildcards?
3. Why must OPTIONS always be in Allow-Methods?
4. What happens if the server lists GET but the browser asks for POST?
5. Are method names case-sensitive in this header?

Answers:

1. Access-Control-Request-Method.
2. Yes, the wildcard * is allowed in modern browsers for methods, but not with credentials.
3. Because preflight requests use the OPTIONS method.
4. The browser blocks the actual POST request.
5. Yes. Methods must be uppercase (GET, POST, DELETE).

Challenge: Implement a CORS middleware that dynamically generates Allow-Methods based on the routes registered in your application, ensuring every listed method actually exists.

FAQ

Mini Project

Create a CORS methods audit tool: scan all routes in an Express or Flask application, collect the registered HTTP methods, and generate the appropriate Access-Control-Allow-Methods header for each route. Include a report showing which routes have methods listed in Allow-Methods that do not actually exist.

What's Next

Study Access-Control-Allow-Headers to understand how custom headers are permitted, then explore Access-Control-Expose-Headers for response header visibility.