# HTTP 400：CORS 预检请求失败，缺少 Access-Control-Request-Method。

- **ID:** `python/fastapi-cors-preflight-400`
- **领域:** python
- **类别:** network_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

未添加 CORSMiddleware，或在会短路 OPTIONS 的中间件之后添加；或 allow_methods 未包含该方法。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 0.100.x | active | — | — |
| 0.110.x | active | — | — |

## 解决方案

1. **** (95% 成功率)
   ```
   app.add_middleware(CORSMiddleware, allow_origins=['https://app.example.com'], allow_methods=['GET','POST','PUT','DELETE','OPTIONS'], allow_headers=['*'], allow_credentials=True) — add FIRST before other middlewares.
   ```
2. **** (90% 成功率)
   ```
   Verify order: middleware added later wraps earlier ones; CORS should be outermost.
   ```

## 无效尝试

- **** — Tedious and misses middleware ordering; CORSMiddleware already handles preflight. (80% 失败率)
- **** — Browsers reject wildcard with credentials. (90% 失败率)