Blog
HTTP 204 No Content for CORS preflight: when empty bodies are correct
Successful OPTIONS responses often use 204 with required Access-Control-* headers and no response body.
1 min read
corspreflighthttp
Status code choices
Both 200 and 204 are common for preflight success; pick one convention per API and document it.
Clients should treat any 2xx with valid CORS headers as success regardless of body length.
Framework pitfalls
Some templating layers strip headers when the body is empty—add integration tests for OPTIONS routes.
Log status and header names in staging when migrating between HTTP stacks.