Allow the Request

Allow Method

The response allows the requested method.

highlighted = computed this step

The response allows POST

The allow-methods row includes the same method that the preflight request asked about.

method allowed=yes\text{method allowed}=\text{yes}
Allow methodThe CORS allow headers and empty response body are recomputed from pinned bytes.Allow method - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

Requested method and allowed method match

The check row compares the requested method to the allow-methods response row.

POST matches POST\text{POST matches POST}
Allow methodThe CORS allow headers and empty response body are recomputed from pinned bytes.Allow method - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

This answer is permission, not resource data

The empty body keeps the preflight response separate from the later toy API request.

permission answer only\text{permission answer only}
Allow methodThe CORS allow headers and empty response body are recomputed from pinned bytes.Allow method - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

Summary

The server allows the origin and the requested method in exact response headers.

allow-method checked\text{allow-method checked}
Allow methodThe CORS allow headers and empty response body are recomputed from pinned bytes.Allow method - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty