CORS Cross Origin
Preflight Request Rejected
Preflight FailedReviewed for reference consistency: August 11, 2026
the server OPTIONS response fails access control checks.
What Preflight Failed Means
The Preflight Failed error on the CORS Cross Origin indicates preflight request rejected — the server options response fails access control checks.. This typically occurs due to the backend server does not have routing configured to respond to http options requests..
When a frontend makes a complex cross-origin request (PUT, DELETE, custom headers, or JSON content type), the browser first sends an HTTP OPTIONS preflight. Chrome displays: "Response to preflight request doesn't pass access control check." The preflight must return a 200–299 status with the correct Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers. If any are missing, the actual request never sends.
How to fix Preflight Failed
General informational guidance, not professional advice. Commands can affect your system or data — back up first and proceed at your own risk. FixerCode is an independent reference, not affiliated with any vendor mentioned.
Test preflight with cURL
Manually simulate the browser's preflight request in your terminal to see exactly what status code and headers the server returns.
curl -i -X OPTIONS -H "Origin: http://localhost:3000" -H "Access-Control-Request-Method: PUT" http://api.example.com/dataHandle OPTIONS explicitly
Ensure your backend routing explicitly catches OPTIONS requests and returns a 200 or 204 No Content status, along with all required CORS headers.
Configure Cloud Gateways
If using AWS API Gateway, ensure you click 'Enable CORS' on the resource, which automatically generates the necessary MOCK integration for OPTIONS.
Technical Background
The preflight request acts as a critical safety mechanism. If a frontend wants to perform an action that could permanently modify server data (like a DELETE request), it would be dangerous to send the request blindly. The browser first sends an OPTIONS request to verify that the server understands CORS and explicitly permits the action.
The preflight response from the server must include specific headers to approve the impending request: 'Access-Control-Allow-Origin', 'Access-Control-Allow-Methods' (listing the allowed HTTP verbs), and 'Access-Control-Allow-Headers' (listing allowed custom headers).
If the server replies with an error status (like 403 Forbidden or 500 Error), or simply lacks the correct CORS headers in its response, the preflight evaluation fails.
Once a preflight fails, the browser immediately halts. The actual intended request (the PUT, DELETE, etc.) is never sent to the network. This prevents unauthorized state-changing operations from occurring on the backend.
Common Causes
- The backend server does not have routing configured to respond to HTTP OPTIONS requests.
- The server responds to OPTIONS requests with an error status code, such as 403 Forbidden, 401 Unauthorized, or 500 Internal Server Error.
- The preflight response is successful (200 OK) but is missing the required 'Access-Control-Allow-Methods' or 'Access-Control-Allow-Headers' headers.
Typical Scenarios
- Sending a POST request with JSON data ('Content-Type: application/json') to an older API that is only configured to expect simple form-urlencoded data.
- Including a JWT token in an 'Authorization: Bearer <token>' header when the backend hasn't explicitly permitted the Authorization header.
- An AWS API Gateway or similar cloud load balancer rejecting OPTIONS requests because CORS configuration was not enabled on that specific resource route.
What to Know
You must configure your web server, application framework, or API gateway to explicitly respond to HTTP OPTIONS requests with a 200 OK or 204 No Content status, and the appropriate CORS headers. Pay special attention to cloud gateways (like AWS API Gateway) which often require manual setup for OPTIONS routes. Also, ensure any authentication middleware ignores OPTIONS requests, as browsers do not send tokens during preflight.
Frequently Asked Questions
Common questions about CORS Preflight Failed error
A preflight request is a transparent, automatic HTTP OPTIONS request the browser sends before sending your actual 'complex' request. It asks the server, 'Hey, I want to send a PUT request with an Authorization header from site-a.com. Is that allowed?'
Browsers consider certain requests 'simple' (like GET or POST with standard form data and no custom headers). Because these types of requests have been possible since the early days of HTML forms, they do not require a preflight check for backwards compatibility.
Yes! You can configure your server to return the 'Access-Control-Max-Age' header during the preflight response. This tells the browser to cache the preflight permissions for a specific number of seconds, completely eliminating the OPTIONS overhead for subsequent requests.
Preflight OPTIONS requests are sent by the browser without any credentials (no cookies, no Auth headers). If your backend server has blanket authentication middleware that demands a token for every single route, it will incorrectly block the OPTIONS request. You must configure your auth middleware to bypass OPTIONS requests.
Related Error Codes
Related Errors From Other Categories
Similar error codes documented across different platforms and systems