HTTP headers
Access-Control-Allow-Methods HTTP Header Meaning
Access-Control-Allow-Methods lists methods allowed by a CORS preflight.
Meaning
The server is telling the browser which request methods the cross-origin request may use.
Where it appears
Servers send it on preflight OPTIONS responses.
What to check
Check that it includes the requested method and does not expose broader methods than intended.
Example
Access-Control-Allow-Methods: GET, POST, OPTIONS