Simple definition
The HTTP OPTIONS method asks which communication options are supported for a resource or server.
Purpose and use
OPTIONS requests communication options supported for a resource or server.
How does it work?
Browsers use it for selected CORS preflight requests to check permitted methods and headers before sending the application request.
Example and verification
If a Web call fails before the actual operation is sent, inspect OPTIONS and the relevant Access-Control-Allow-* fields.
Points to watch
Successful preflight does not prove that the user is authorized. Not every cross-origin request requires preflight.
In short
OPTIONS describes exchange capabilities; authentication and authorization must still be enforced by the API.