HTTP OPTIONS and GET / POST / PUT methods

[#1]

Hi,

I have few queries.

1. I guess every HTTP request made up of 2 request. options and followed by methods.

2. Do we really need to send OPTION Request. Is that mandatory ?

3. Is it possible to merge both OPTION and followed by Methods into single call so that APIGEE receives nearly half of the request .

4. Are you charging for a single request or you're charging for OPTION too ? What's the significant of it.

Thanks,

Raja K

,

[DChiesa]

Your question and your title appear to be duplicated.

OPTIONS is just one of the standard HTTP Methods. Others include GET, POST, PUT, DELETE, HEAD, and PATCH. These are sometimes called "verbs". They are defined in the relevant IETF standards, see RFC 2616 for a start. Every HTTP request sends exactly one method.

It is not the case that every request includes an OPTIONS and a second method. It is not the case that every non-OPTIONS HTTP request must be preceded by an OPTIONS HTTP request.

You may be observing a CORS preflight request. CORS is a convention applied by web browsers to improve the security when a web page calls an API that is not hosted on the same domain as the webpage itself. In other words, suppose you load a page like www.examplebank.com, and it includes Javascript code that tries to call APIs hosted on exampleservices.com. By default the browser will prevent this. CORS describes a mechanism by which the browser cooperates with the server to allow or deny those so-called "cross-origin" requests. When the Javascript code loaded in that webpage tries to call the APIs, in some circumstances, the browser itself will send an OPTIONS request in order to verify that the application code ought to be allowed to invoke the APIs.

For more on CORS preflights, see here or here.

To provide some answers:

• Apigee Edge can be used to proxy API calls that use CORS.
• Apigee Edge can apply CORS protection on backend APIs that are not protected by CORS.
• Apigee Edge does not, by default, require a caller to make an OPTIONS call before any other call.
• Apigee Edge can proxy OPTIONS calls outside the context of CORS.

[#3]

Hi,

Thanks for the detailed technical Information. Can you quickly suggest me yes / no for the below questions.

1. Do we really need to send OPTION Request. Is that mandatory ?

2. Is it possible to merge both OPTION and followed by Methods into single call so that APIGEE

receives nearly half of the request. Also, I don't think there is any other change in OPTION / POST

Headers from the client. Correct me if I am wrong.

3. Are you charging for a single request or you're charging for OPTION too ? What's the significant of it.

Thanks,

Raja K

[DChiesa]

1. The OPTIONS request is sent by the browser automatically (and implicitly) when there is an XHR request to a domain that is not the origin. This is how CORS works. This has nothing to do with Apigee Edge.

2. No, there is no way to merge the OPTIONS and the second request. This is just how CORS works. This has nothing to do with Apigee Edge.

3. Apigee Edge is licensed on a usage basis. Each inbound API request counts, whether it is OPTIONS, PUT, POST, GET, etc. If there is an OPTIONS followed by a POST, then that will count as 2 requests.