Preflight (OPTIONS) Requests Fail even with CORs set

TL;DR

Upgrade Flipt past the v2 beta builds: preflight (OPTIONS) requests failing despite CORS being enabled was a bug in the v2 betas, fixed in the stable v2 release. If you are on a beta, upgrading is the fix.

The problem

With cors: enabled: true in the Flipt YAML config, GET requests work but the OPTIONS preflight request does not supply the same CORS settings, so flipt-web (or any browser client) fails.

Fix it

1. Check your Flipt version. Success check: you are on a v2 beta build, confirming the bug applies.

2. Upgrade to the stable v2 release or newer. Success check: the installed version is past the beta line.

3. Re-run the browser flow that failed. Success check: the OPTIONS preflight returns the CORS headers and the request succeeds.

When this applies

• Flipt v2 beta with cors: enabled: true in config.
• GET works, OPTIONS preflight fails.

When it does not apply

• Flipt v1; the bug is v2-beta-specific.
• CORS failures caused by your own reverse proxy stripping headers.
• Non-browser clients (no preflight involved).

Compatibility

• Flipt v2 stable+ (fixed). Affected: v2 beta builds.

Variant phrasings

• Flipt preflight OPTIONS fail CORS set
• flipt-web CORS preflight failure
• Flipt v2 beta CORS bug

Why it happens

The v2 beta server did not apply the CORS middleware to OPTIONS requests, only to the main routes. The stable release applies it uniformly.

Edge cases

• If it persists on stable v2, check for a proxy in front of Flipt stripping the headers.
• Source: https://github.com/flipt-io/flipt/issues/4620

In gh:flipt-io/flipt#4620, the reporter ran into: Issue flipt-io/flipt#4620 (closed, 12 comments): The OPTIONS request does not supply the same CORS settings as the GET request does which means flipt-web fail. (IPs are all internal resources so I left them as is) Yaml Config `` cors: enabled: true GET request `` Preparing request to http://CONTAINER_IP:3524/internal/v1/evaluation/snapshot/namespace/iris Current time is 2025-08-28T20:25:02.535Z Enable automatic URL encoding Using default HTTP version Disable SSL validation Enable cookie sending with jar of 24 cookies Connection 17 seems to be dead Closing connection 17 *... The verified answer was: Preflight (OPTIONS) requests failing on Flipt v2 with CORS set: that was a bug in the v2 beta builds, fixed in the release versions. Upgrade from the beta to the latest v2 release (non-beta). Source issue: https://github.com/flipt-io/flipt/issues/4620