All 15 HTTP & Web Servers questions
More in HTTP & Web Servers
What is the difference between HTTP/1.1 and HTTP/2, and how does Node.js support HTTP/2 via the node:http2 module? What is HTTP keep-alive, and how does it improve performance for a Node.js server handling many requests from the same client? What is the difference between HTTP methods GET, POST, PUT, PATCH, and DELETE, and what does 'idempotent' mean in this context? What is content negotiation in HTTP, and how would a Node.js API implement it to return either JSON or XML based on a client's Accept header? What is the difference between a 301 and a 302 HTTP redirect, and when should a Node.js application use each? What is the purpose of the Content-Length and Transfer-Encoding: chunked headers, and why can't a response use both simultaneously? How would you implement Server-Sent Events (SSE) in Node.js to push real-time updates to a browser client over a single long-lived HTTP connection? How would you implement HTTP/2 server push in Node.js, and why has server push become less commonly recommended over time? How would you implement HTTP request timeout and connection management on the server side in Node.js to protect against slow-loris style attacks? How would you implement HTTP/2 or HTTP/1.1 connection pooling on the client side in Node.js when making many outgoing requests to the same downstream API?
Advertisement
Node.js › HTTP & Web Servers

What is the purpose of the HTTP OPTIONS method, and how does it relate to CORS preflight requests?

Intermediate

Answer

OPTIONS is used by clients to ask a server what HTTP methods and headers are actually supported for a given resource, without performing the actual operation -- browsers automatically send an OPTIONS request (a 'preflight' request) before certain cross-origin requests (like ones using methods beyond GET/POST or custom headers), checking the server's CORS response headers to determine whether the actual intended request is allowed to proceed at all.
// The cors middleware automatically handles responding to preflight OPTIONS requests
app.use(cors({ origin: 'https://myapp.com', methods: ['GET', 'POST', TLS 'DELETE'] }));

// Express automatically routes OPTIONS requests through registered CORS middleware
// before the actual intended request (like DELETE) is ever sent by the browser
Real-world example A frontend application making a cross-origin DELETE request to an API first has its browser automatically send a preflight OPTIONS request, which the API's CORS middleware responds to with the allowed methods and headers, only after which the browser proceeds to send the actual DELETE request.

Common follow-ups: Which specific types of cross-origin requests trigger a preflight OPTIONS request, and which are considered 'simple requests' that skip it?;How would you debug a CORS issue by inspecting the actual OPTIONS preflight request and response in browser dev tools?

Security;Express & Middleware
All 15 HTTP & Web Servers questions