title: Why doesn't adding CORS headers to an OPTIONS route allow browsers to access my API?
body: <p>I am trying to support CORS in my Node.js application that uses the Express.js web framework. I have read <a href="http://groups.google.com/group/express-js/browse_thread/thread/71db58df2c74d06a" rel="noreferrer">a Google group discussion</a> about how to handle this, and read a few articles about how CORS works. First, I did this (code is written in CoffeeScript syntax):</p>
  
  <pre><code>app.options "*", (req, res) -&gt;
    res.header 'Access-Control-Allow-Origin', '*'
    res.header 'Access-Control-Allow-Credentials', true
    # try: 'POST, GET, PUT, DELETE, OPTIONS'
    res.header 'Access-Control-Allow-Methods', 'GET, OPTIONS'
    # try: 'X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept'
    res.header 'Access-Control-Allow-Headers', 'Content-Type'
    # ...
  </code></pre>
  
  <p>It doesn't seem to work. It seems like my browser (Chrome) is not sending the initial OPTIONS request. When I just updated the block for the resource I need to submit a cross-origin GET request to:</p>
  
  <pre><code>app.get "/somethingelse", (req, res) -&gt;
    # ...
    res.header 'Access-Control-Allow-Origin', '*'
    res.header 'Access-Control-Allow-Credentials', true
    res.header 'Access-Control-Allow-Methods', 'POST, GET, PUT, DELETE, OPTIONS'
    res.header 'Access-Control-Allow-Headers', 'Content-Type'
    # ...
  </code></pre>
  
  <p>It works (in Chrome). This also works in Safari.</p>
  
  <p>I have read that...</p>
  
  <blockquote>
    <p>In a browser implementing CORS, each cross-origin GET or POST request is preceded by an OPTIONS request that checks whether the GET or POST is OK.</p>
  </blockquote>
  
  <p>So my main question is, how come this doesn't seem to happen in my case? Why isn't my app.options block called? Why do I need to set the headers in my main app.get block?</p>