CORS Cross Origin
Preflight Failed
Reviewed for reference consistency: August 11, 2026
Response to preflight request doesn't pass access control check.
What Preflight Failed Means
The Preflight Failed error on the CORS Cross Origin indicates preflight failed — response to preflight request doesn't pass access control check.. This typically occurs due to the backend server does not have routing configured to respond to http options requests..
When a frontend application attempts to make a 'complex' cross-origin request (such as using methods like PUT, PATCH, or DELETE, or sending custom headers like 'Authorization' or 'Content-Type: application/json'), the browser must first ask the server for permission. It does this by sending a preliminary HTTP OPTIONS request, known as a preflight. If this OPTIONS request fails, or if it doesn't return the exact permissions required, the browser decisively aborts the actual intended request.
How to fix Preflight Failed
General informational guidance, not professional advice. Commands can affect your system or data — back up first and proceed at your own risk. FixerCode is an independent reference, not affiliated with any vendor mentioned.
Test preflight with cURL
Manually simulate the browser's preflight request in your terminal to see exactly what status code and headers the server returns.
curl -i -X OPTIONS -H "Origin: http://localhost:3000" -H "Access-Control-Request-Method: PUT" http://api.example.com/dataHandle OPTIONS explicitly
Ensure your backend routing explicitly catches OPTIONS requests and returns a 200 or 204 No Content status, along with all required CORS headers.
Configure Cloud Gateways
If using AWS API Gateway, ensure you click 'Enable CORS' on the resource, which automatically generates the necessary MOCK integration for OPTIONS.
Technical Background
The preflight request acts as a critical safety mechanism. If a frontend wants to perform an action that could permanently modify server data (like a DELETE request), it would be dangerous to send the request blindly. The browser first sends an OPTIONS request to verify that the server understands CORS and explicitly permits the action.
The preflight response from the server must include specific headers to approve the impending request: 'Access-Control-Allow-Origin', 'Access-Control-Allow-Methods' (listing the allowed HTTP verbs), and 'Access-Control-Allow-Headers' (listing allowed custom headers).
If the server replies with an error status (like 403 Forbidden or 500 Error), or simply lacks the correct CORS headers in its response, the preflight evaluation fails.
Once a preflight fails, the browser immediately halts. The actual intended request (the PUT, DELETE, etc.) is never sent to the network. This prevents unauthorized state-changing operations from occurring on the backend.
Common Causes
- The backend server does not have routing configured to respond to HTTP OPTIONS requests.
- The server responds to OPTIONS requests with an error status code, such as 403 Forbidden, 401 Unauthorized, or 500 Internal Server Error.
- The preflight response is successful (200 OK) but is missing the required 'Access-Control-Allow-Methods' or 'Access-Control-Allow-Headers' headers.
Typical Scenarios
- Sending a POST request with JSON data ('Content-Type: application/json') to an older API that is only configured to expect simple form-urlencoded data.
- Including a JWT token in an 'Authorization: Bearer <token>' header when the backend hasn't explicitly permitted the Authorization header.
- An AWS API Gateway or similar cloud load balancer rejecting OPTIONS requests because CORS configuration was not enabled on that specific resource route.
What to Know
You must configure your web server, application framework, or API gateway to explicitly respond to HTTP OPTIONS requests with a 200 OK or 204 No Content status, and the appropriate CORS headers. Pay special attention to cloud gateways (like AWS API Gateway) which often require manual setup for OPTIONS routes. Also, ensure any authentication middleware ignores OPTIONS requests, as browsers do not send tokens during preflight.
Frequently Asked Questions
Common questions about CORS Preflight Failed error
A preflight request is a transparent, automatic HTTP OPTIONS request the browser sends before sending your actual 'complex' request. It asks the server, 'Hey, I want to send a PUT request with an Authorization header from site-a.com. Is that allowed?'
Browsers consider certain requests 'simple' (like GET or POST with standard form data and no custom headers). Because these types of requests have been possible since the early days of HTML forms, they do not require a preflight check for backwards compatibility.
Yes! You can configure your server to return the 'Access-Control-Max-Age' header during the preflight response. This tells the browser to cache the preflight permissions for a specific number of seconds, completely eliminating the OPTIONS overhead for subsequent requests.
Preflight OPTIONS requests are sent by the browser without any credentials (no cookies, no Auth headers). If your backend server has blanket authentication middleware that demands a token for every single route, it will incorrectly block the OPTIONS request. You must configure your auth middleware to bypass OPTIONS requests.
Related Error Codes
Related Errors From Other Categories
Similar error codes documented across different platforms and systems