Why does my server return 405 Method Not Allowed for preflight requests?

Most web frameworks do not automatically handle OPTIONS requests. If you only define GET and POST routes for an endpoint, the framework returns 405 when the browser sends OPTIONS. Fix this by explicitly handling OPTIONS (e.g., app.options in Express) or by using CORS middleware that automatically intercepts OPTIONS requests before they reach your route handlers.

Why does my preflight fail with 401 Unauthorized?

Preflight OPTIONS requests never include cookies or Authorization headers. If your authentication middleware runs before CORS middleware, it rejects the preflight for lacking credentials. The fix is to ensure CORS middleware executes first and responds to OPTIONS immediately, or configure your auth middleware to skip OPTIONS requests (e.g., requestMatchers(HttpMethod.OPTIONS).permitAll() in Spring Security).

How do I cache preflight responses to avoid the extra round trip?

Set the Access-Control-Max-Age header in your preflight response. A value of 86400 (24 hours) is ideal, though browsers cap it differently: Chrome allows up to 2 hours, Firefox up to 24 hours, and Safari up to 10 minutes. The cache key is origin + URL + method + headers, so requests with different custom header sets trigger separate preflights.

Why do I see CORS errors on 500 Internal Server Error responses?

Many server configurations only add CORS headers on successful responses. When the server returns 500, the CORS headers are missing, and the browser shows a CORS error instead of the actual server error. Fix this by ensuring CORS headers are added to all responses regardless of status code. In Nginx, use the 'always' flag with add_header. In Express, place cors() middleware before error handlers.

How can I debug preflight failures in the browser?

Open DevTools Network tab and look for the OPTIONS request that precedes your failing request. Check its status code (should be 200 or 204), and inspect response headers for Access-Control-Allow-Origin, Allow-Methods, and Allow-Headers. Then check the Console tab for the specific CORS error message, which tells you exactly what is missing (e.g., which header is not in the Allow-Headers list).

Resolving Preflight Request Failures