Meaning
The OPTIONS HTTP method requests information about the communication options available for a target resource, returning allowed methods, headers, and CORS-relevant metadata. It addresses the need for clients to discover server capabilities before making actual requests, particularly across origins. It is triggered when a browser issues a preflight check before a non-simple cross-origin request, or when a client wants to enumerate allowed methods on a resource.
Primary Function
API discovery
Communicative Purpose
Enables clients to discover allowed HTTP methods, headers, and CORS policies before sending actual requests to a resource.
Pattern
OPTIONS /resource
Core Structure
OPTIONS /...
Função primária
API discovery
Propósito comunicativo
Enables clients to discover allowed HTTP methods, headers, and CORS policies before sending actual requests to a resource.
Situações de gatilho
Web APIs: CORS preflight before cross-origin POST with custom headers REST services: client probing to enumerate supported methods on a resource API gateways: middleware inspecting allowed operations for routing decisions
Contextos
REST APIs, HTTP servers, CORS-enabled web applications, API gateways, OpenAPI specifications
Padrão
OPTIONS /resource
Estrutura central
OPTIONS /...
Slots de substituição
resource: target URI path identifying the API endpoint
Colocados típicos
- Access-Control-Request-Method header
- Access-Control-Request-Headers header
- Allow response header
- CORS middleware
- preflight handlers
Substituições comuns
- HEAD /resource: lightweight metadata probe without CORS preflight semantics GET /resource: actual resource retrieval when capability discovery is not needed
Erros comuns
Treating OPTIONS as a data-modifying call: OPTIONS is safe and idempotent and must not alter server state Forgetting to respond to preflight: browsers block the actual request if OPTIONS returns non-2xx without proper CORS headers Returning 405 instead of 200 with Allow header: clients lose the method enumeration capability Confusing OPTIONS with TRACE: TRACE echoes the request for diagnostics, OPTIONS enumerates capabilities
Similar / contraste
HEAD: retrieves headers only without body, no CORS preflight role GET: retrieves representation, not capability metadata TRACE: diagnostic echo of the request line and headers
Interferências
Coming from REST-only mental models: may assume OPTIONS is optional and skip preflight handling — browsers enforce CORS preflight automatically for non-simple cross-origin requests. Coming from SOAP/WSDL: may expect OPTIONS to return a full service description — REST OPTIONS typically returns only Allow header and CORS headers.
Família do chunk
- HTTP methods (GET
- POST
- PUT
- DELETE
- PATCH
- HEAD
- OPTIONS
- TRACE)
- CORS preflight
- Allow response header
Nuance
When NOT to use: do not invoke OPTIONS manually in application code; browsers handle preflight automatically. Performance: each preflight adds a round-trip latency before the actual request, so caching preflight responses via Access-Control-Max-Age reduces overhead. Boundary: OPTIONS responses must include Access-Control-Allow-Origin for cross-origin requests to succeed, and the Allow header should list every method the resource supports.
Efeito pragmático
Correctly handling OPTIONS enables cross-origin browser requests to succeed without manual proxy configuration and lets API clients discover supported operations without trial-and-error failures.
Dica de memória
OPTIONS is the polite knock on the API door — it asks 'what may I do here?' before committing to an action.
Upgrade path
CORS preflight configuration and Access-Control-Max-Age caching strategies
Log in to save chunks.