Answer a CORS preflight

OPTIONS/api

Answers a browser's CORS preflight for any /api/ path. The route needs no token. For an Origin of http://localhost:<port>, http://127.0.0.1:<port> or http://<host>:<port> (the address the server is bound to), the response carries the Access-Control-Allow-* headers, and every other origin gets none. The same headers are added to a normal response from a route when the request has one of those origins. Access-Control-Allow-Methods lists GET, POST, OPTIONS, which leaves out PUT, the method of the config save routes.

Headers

Originstring

The origin of the page making the cross-origin request.

Example: http://localhost:8080

Response

204

No body. The allow headers are present only for a matching origin.

Response headers

Access-Control-Allow-Originstring

The request's Origin, echoed back.

Access-Control-Allow-Methodsstring

GET, POST, OPTIONS. PUT is not in the list.

Access-Control-Allow-Headersstring

Content-Type, Authorization.

cURLcURLPythonJavaScript

curl --request OPTIONS \
  --url 'http://localhost:8080/api/' \
  --header 'Origin: http://localhost:8080'

{}