Ask First

Requested Method

The request says which method it wants to use later.

highlighted = computed this step

The request asks about POST

The Access-Control-Request-Method row names the later method.

requested method=POST\text{requested method}=\text{POST}
Requested methodThe preflight request, allow response, and checks are recomputed from pinned bytes.Requested method - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

The method is in a header

The browser has not sent the POST body here; it is asking whether POST is allowed.

method question in header\text{method question in header}
Requested methodThe preflight request, allow response, and checks are recomputed from pinned bytes.Requested method - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

The answer must allow that method

Chapter two compares this requested method to the allow-methods response row.

compare request to response\text{compare request to response}
Requested methodThe preflight request, allow response, and checks are recomputed from pinned bytes.Requested method - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

Summary

The preflight request carries the origin and the method it wants to use.

preflight question assembled\text{preflight question assembled}
Requested methodThe preflight request, allow response, and checks are recomputed from pinned bytes.Requested method - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty