OPTIONS request handlers will not work unless `${key}.prefli

Error message

OPTIONS request handlers will not work unless `${key}.preflightContinue` is set to `true`

What it means

resolve_cors in the Vite plugin computes the effective `server.cors`/`preview.cors` setting. When the user supplied a cors object without `preflightContinue`, OPTIONS requests are consumed by Vite and SvelteKit's `OPTIONS` route handlers will never fire; this warning tells you to set `preflightContinue: true` (SvelteKit already defaults it when cors is left unset).

Source

Thrown at packages/kit/src/exports/vite/index.js:69

 * @returns {CorsOptions | undefined}
 */
function resolve_cors(user_cors, key, warn) {
	// `preview.cors` falls back to the resolved `server.cors`, so emitting a value here when
	// the user hasn't set one is what drops Vite's `defaultAllowedOrigins` restriction
	if (user_cors === undefined) {
		return key === 'server.cors' ? { preflightContinue: true } : undefined;
	}

	// with `cors: false` Vite installs no CORS middleware, so OPTIONS handlers already work
	if (user_cors === false) return undefined;

	if (typeof user_cors === 'object' && user_cors !== null) {
		if (user_cors.preflightContinue === undefined) return { preflightContinue: true };
		if (user_cors.preflightContinue) return undefined;
	}

	if (warn) {
		console.warn(
			styleText(
				['yellow', 'bold'],
				`OPTIONS request handlers will not work unless \`${key}.preflightContinue\` is set to \`true\``
			)
		);
	}

	return undefined;
}

const removed_modules = [
	{
		name: '$lib',
		pattern: /^\$lib(?:\/.*|\?.*)?$/,
		message:
			"`$lib` has been removed. Use `#lib` instead: https://svelte.dev/docs/kit/$lib. To keep using `$lib`, add `alias: { '$lib': 'src/lib' }` to your SvelteKit config."
	},
	{

View on GitHub (pinned to 03f1687fe6)

Solutions

Set `cors: { preflightContinue: true, ... }` under `server` (and `preview` if needed) in vite.config.js
Remove the explicit cors object entirely so SvelteKit's default (`preflightContinue: true`) applies
Only if you don't use OPTIONS handlers, set `preflightContinue: false` knowingly to silence it

Example fix

// before (vite.config.js)
export default { server: { cors: { origin: 'https://app.dev' } } };
// after
export default { server: { cors: { origin: 'https://app.dev', preflightContinue: true } } };

Defensive patterns

Strategy: validation

Validate before calling

// validate vite config before dev
const cors = config.server?.cors;
if (typeof cors === 'object' && cors !== null && cors.preflightContinue === undefined) {
  console.warn('set server.cors.preflightContinue = true for OPTIONS handlers');
}

Type guard

const needsPreflightContinue = (cors) => typeof cors === 'object' && cors !== null && cors.preflightContinue === undefined;

Prevention

Prefer omitting `cors` entirely and let SvelteKit defaults apply
Document any custom cors objects in the repo and include preflightContinue
Smoke-test OPTIONS routes with curl after touching vite.config

When it happens

Trigger: Setting `server.cors` (or `preview.cors`) to an object like `{ origin: true }` in vite.config without `preflightContinue`, while the app defines `export async function OPTIONS()` handlers.

Common situations: Adding CORS config for an external dev origin; following generic Vite CORS guides while also having SvelteKit route handlers for OPTIONS.

Related errors

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/961029745f6156c4. Report an issue: GitHub.