The short version
- 01Check the exact failing URL and HTTP method in the request details.
- 02Read the response's Allow header for the resource's supported methods.
- 03Use the endpoint and method documented for the intended operation.
- 04Inspect OPTIONS separately when the failure occurs during a browser preflight.
- 05Correct route handling and the intended CORS policy when maintaining the service.
- 06Retest the original operation without converting a write into an unrelated GET request.
Raw message
405 Method Not Allowed
Likely causes
- The endpoint does not support the submitted HTTP method.
- A form or API client sends a valid method to the wrong URL.
- A route or server configuration rejects a method the application expects.
- An OPTIONS preflight is rejected before the browser sends the intended request.
The method matters as well as the address
A 405 means the server recognises the method but the resource does not support it. The response must include Allow with the supported methods. This differs from a missing resource or a permission refusal.
For example, a URL can accept GET to read an item while refusing POST there. That does not establish which separate endpoint creates an item. Consult the API contract rather than trying methods until an error disappears.
If a page or form produces 405
Our diagnostic recommendation is to reopen the form from the site's navigation and note whether viewing works but submission fails. A form wired to the wrong destination can expose a server-side integration problem that a visitor cannot repair.
Give support the page address and action that failed. For developers reproducing the issue, copying a submission URL into the address bar is a different test: normal navigation sends GET rather than reproducing a form's POST. A successful page view does not prove the submission endpoint is fixed.
If an API works outside the browser
Inspect the browser's failing request. Some cross-origin calls first send OPTIONS to ask whether the intended method and headers are permitted. A 405 on OPTIONS can stop the actual application request from being sent at all, even if a direct API-client test succeeds.
Handle the preflight at the correct route or middleware layer, with a policy for the intended origins, methods and headers. Allow describes resource methods in HTTP; Access-Control-Allow-Methods belongs to the browser's CORS exchange. Merely adding one header does not implement a missing route or satisfy the entire preflight.
If the actual method receives 405, compare the deployed route and server configuration with the endpoint documentation. Preserve the operation's meaning: changing a failed update into GET may fetch data but does not complete the update.
Sources and review notes
Checked on . Based on HTTP semantics and MDN's method and CORS documentation. The browser-versus-client comparison is editorial diagnostic guidance, not evidence that every 405 is a CORS issue.