Access-control-allow-methods

As explained in Spring Security in Action, Second Edition

Access-Control-Allow-Methods is an HTTP response header that specifies the HTTP methods permitted for cross-origin requests.

Access-Control-Allow-Methods is a CORS response header that limits cross-origin access to selected HTTP methods, such as allowing an external origin to use only GET. section 10.1

Use the header to:

• Declare which methods a browser may accept for a cross-origin request. section 10.1
• Validate preflight behavior by checking the header returned for an HTTP OPTIONS request. section 18.7

Testing an allowed POST method

A MockMvc test sends OPTIONS to /test with Access-Control-Request-Method: POST and verifies that Access-Control-Allow-Methods equals POST. section 18.7

Figure 10.4 For simple requests, the browser sends the original request directly to the server. The browser rejects the response if the server doesn’t allow the origin. In some cases, the browser sends a preflight request to test whether the server accepts the origin. If the preflight request succeeds, the browser sends the original request.

For some cross-origin requests, the browser sends a preflight request first and sends the original request only when the server permits it. section 10.1

How Spring Security in Action, Second Edition covers it

How deep it goes

Defines the header and demonstrates exact-value testing, without detailing its configuration implementation.

Examples

Uses a cross-origin /test endpoint, a POST request, and a MockMvc OPTIONS test expecting POST.

What it assumes

Assumes understanding of browser same-origin restrictions, CORS policies, HTTP methods, and response headers.

What you can do after

Diagnose CORS policies by asserting allowed methods and origins with MockMvc preflight requests.

How it connects

Connects CORS with Access-Control-Allow-Origin, Access-Control-Allow-Headers, preflight requests, and HTTP OPTIONS.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

• CORSused by · Cross-Origin Resource Sharing (CORS) is a web standard that uses HTTP headers to let servers specify which origins may access their resources through browsers.
• Access-Control-Allow headersconfigured by · Access-Control-Allow response headers are HTTP response headers that specify which cross-origin origins, methods, or request headers a server permits under CORS.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.