// http header · cors header

Access-Control-Allow-Methods

Methods allowed for the resource

What the Access-Control-Allow-Methods header does

Access-Control-Allow-Methods lists the HTTP methods permitted for a cross-origin resource. It's returned in the preflight (OPTIONS) response so the browser knows whether the real request's method is allowed.

Example

Access-Control-Allow-Methods: GET, POST

Access-Control-Allow-Methods in practice

Preflight response

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Max-Age: 600

Common Access-Control-Allow-Methods questions and problems

Method ... is not allowed by Access-Control-Allow-Methods in preflight response

The browser sent an OPTIONS preflight asking about a method such as PUT or DELETE, and the answer did not list it. Return the method in this header on the OPTIONS response.

Where should this header be sent?

Mainly on the response to the preflight (OPTIONS) request. It is not needed on the actual response.

Is GET always allowed?

GET, HEAD and POST are CORS-safelisted methods and do not need to be listed, though many servers list them anyway for clarity.

Access-Control-Allow-Methods vs related headers

Access-Control-Allow-Headers: Allow-Methods covers the HTTP verb. Allow-Headers covers the request headers.
Access-Control-Allow-Origin: Allow-Origin controls who may read the response; Allow-Methods only matters for preflighted requests.

Where it's used

Access-Control-Allow-Methods is a cors header. CORS headers govern cross-origin requests — which other origins may read a response.

Other cors headers

Access-Control-Allow-Origin Access-Control-Allow-Methods Access-Control-Allow-Headers Access-Control-Allow-Credentials Access-Control-Max-Age