Skip to main content
2026-07-29 16:01
REST API

OPTIONS for CORS

RequestValidateMedium
Try Interactive Demo

What you will learn

  • Preflight expects Access-Control-Allow-Origin matching the Origin, NOT wildcard when credentials are sent
  • Access-Control-Max-Age caches preflight — test both first request and the cached follow-up
  • Non-simple methods (PATCH, DELETE) require preflight; simple methods (GET, POST with form body) don't

Description

Check CORS preflight response. Verify allowed methods and headers.

Test Scenario

const response = await request.fetch('/api/v1/users', { method: 'OPTIONS' });
expect(response.headers()['access-control-allow-methods']).toContain('GET');
Endpoint/api/v1/users

Testing Tips

  • •OPTIONS returns allowed methods
  • •Check Access-Control headers
  • •Required for cross-origin requests
// Playwright API Testing - REST
import { test, expect } from '@playwright/test';


test('REST API request', async ({ request }) => {
  const response = await request.get('/api/v1/resource');


  expect(response.ok()).toBeTruthy();
  expect(response.status()).toBe(200);


  const data = await response.json();
  expect(data).toBeDefined();
});

Challenge ID: rest-options-cors

2 frameworks available

API Playground

Send requests and inspect responses

Endpoint: /api/v1/users

Press Enter to send