The Access-Control-Allow-Methods response header specifies the HTTP methods permitted when accessing a resource across origins.

Syntax and usage

Sent in response to a preflight OPTIONS request:

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.test
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
Access-Control-Max-Age: 86400
  • Methods like GET, HEAD, and POST are simple methods and do not strictly require preflight on their own unless paired with custom headers.
  • Methods like PUT, DELETE, and PATCH always trigger preflights and require explicit inclusion in Access-Control-Allow-Methods.

Difference with 405 Allow header

  • Access-Control-Allow-Methods: A CORS security header sent in preflight responses to inform browser security engines which verbs are permitted cross-origin.
  • Allow: A standard protocol header sent in 405 Method Not Allowed responses to describe supported verbs on a specific resource URL.

How to test with curl

curl -i -X OPTIONS https://api.example.test/v1/orders/102 \
  -H "Origin: https://app.example.test" \
  -H "Access-Control-Request-Method: DELETE"

Key takeaway

Access-Control-Allow-Methods informs browsers which HTTP methods are permitted for cross-origin calls. Ensure all required REST methods (PUT, DELETE, PATCH) are explicitly listed in preflight responses.