Which FastAPI CORSMiddleware parameters beyond allow_origins fix a PUT preflight?

WHAT THIS TESTS: This question evaluates whether you understand the CORS preflight handshake beyond the basic origin check. Browsers send an OPTIONS preflight for requests that are not simple, which includes PUT methods and requests with custom headers like Authorization. The interviewer wants to see if you know that the middleware must explicitly permit both the method and the header, not just the origin.

A GOOD ANSWER COVERS: First, allow_methods must be configured to include PUT because PUT is not a simple method; by default many CORS middlewares only allow simple methods like GET, HEAD, and POST, so preflight fails without explicit permission. Second, allow_headers must include Authorization because any custom header beyond the simple headers triggers a preflight, and the browser will reject the request if the server does not advertise that header as permissible. Third, a senior candidate might mention allow_credentials if the Authorization header is being sent with credentials, since credentialled requests have additional restrictions such as disallowing wildcard origins. Fourth, you should explain that the browser caches preflight results via the Access-Control-Max-Age header, which corresponds to the max_age parameter in the middleware.

COMMON WRONG ANSWERS: Saying that allow_origins alone fixes the issue reveals a fundamental gap because preflight checks three things: origin, method, and headers. Suggesting that you can simply set allow_origins to a wildcard while also sending credentials is another red flag, as browsers reject this combination for security reasons. Some candidates incorrectly blame the frontend or claim the issue is a missing OPTIONS route, but FastAPI's CORSMiddleware automatically handles OPTIONS responses; the problem is configuration, not routing.

LIKELY FOLLOW-UPS: The interviewer might ask what happens if you omit allow_headers and only set allow_methods, or they might ask how to handle dynamic origins with allow_origin_regex. Another common follow-up is whether you need to manually define an OPTIONS endpoint in FastAPI, which you do not because the middleware intercepts and responds to preflight requests before they reach your path operations. They may also ask about the security implications of overly permissive CORS settings.

ONE CONCRETE EXAMPLE: Imagine a React frontend at http://localhost:3000 calling a FastAPI backend at http://localhost:8000 with a PUT /items/1 endpoint that requires an Authorization Bearer token. The browser sends an OPTIONS request with Access-Control-Request-Method set to PUT and Access-Control-Request-Headers set to authorization. If your CORSMiddleware only sets allow_origins to http://localhost:3000, the preflight returns 200 but without Access-Control-Allow-Methods set to PUT or Access-Control-Allow-Headers set to authorization, so the browser blocks the actual PUT. You must add allow_methods containing PUT and allow_headers containing Authorization to let the request proceed.