# ElasticSearch ignores the property 'http.cors.allow-methods'

**URL:** <https://discuss.elastic.co/t/elasticsearch-ignores-the-property-http-cors-allow-methods/45662>\
**Category:** Elasticsearch\
**Created:** [March 29, 2016, 8:36am UTC](https://discuss.elastic.co/t/elasticsearch-ignores-the-property-http-cors-allow-methods/45662 "2016-03-29T08:36:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![motty.green](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@motty.green](https://discuss.elastic.co/u/motty.green)\
**Post date:** [March 29, 2016, 8:36am UTC](https://discuss.elastic.co/t/elasticsearch-ignores-the-property-http-cors-allow-methods/45662/1 "2016-03-29T08:36:51Z")

</div>

Hi All,

I have added both parameters to elasticsearch.yml:

http.cors.enabled : true  
http.cors.allow-methods : GET, POST, PUT, DELETE

OPTIONS & HEAD are not allowed - and still i can access to ElasticSearch with postman with these methods and get 200 OK response instead of bad request.

10x

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 29, 2016, 9:06am UTC](https://discuss.elastic.co/t/elasticsearch-ignores-the-property-http-cors-allow-methods/45662/2 "2016-03-29T09:06:42Z")

</div>

> [@motty.green](#):
>
> http.cors.enabled : truehttp.cors.allow-methods : GET, POST, PUT, DELETE

These are not valid yml.

```auto
http.cors.enabled: true
http.cors.allow-methods: GET, POST, PUT, DELETE

```

Is the correct syntax.

---

<div class="post-metadata">

**Author:** ![motty.green](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@motty.green](https://discuss.elastic.co/u/motty.green)\
**Post date:** [March 29, 2016, 9:10am UTC](https://discuss.elastic.co/t/elasticsearch-ignores-the-property-http-cors-allow-methods/45662/3 "2016-03-29T09:10:25Z")

</div>

Do you know how it should be ?  
i also tried:  
http.cors.allow-methods: ["GET","POST"]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:04pm UTC](https://discuss.elastic.co/t/elasticsearch-ignores-the-property-http-cors-allow-methods/45662/4 "2017-07-05T23:04:27Z")

</div>