在线商城调用API遇OPTIONS+POST重复请求及API混乱问题求助

First, let's clarify: that OPTIONS request is a preflight request—it's the browser's standard way of checking if your server allows the upcoming POST request during cross-origin calls. This is normal CORS behavior, but the confusion you're seeing comes from your server letting that OPTIONS request bleed into your business logic instead of handling it properly.

Looking at your current CORS config, the preflightContinue: true setting is the main culprit. This tells Express to pass the OPTIONS request through to your subsequent middleware and routes, rather than letting the CORS middleware handle it directly. As a result, your API treats both the OPTIONS (preflight) and POST requests as valid business requests, causing the chaos you're experiencing.

Here's how to fix this:

1. Simplify Your CORS Config (Recommended) #

Remove the preflightContinue: true flag. By default, the cors middleware automatically handles OPTIONS preflight requests, sends back the correct CORS headers, and stops the request from reaching your business routes. Your updated config should look like this:

app.use(cors({ origin: true, credentials: true }));

This ensures only the actual POST request triggers your API logic.

2. If You Need to Keep preflightContinue #

If you have a specific reason to retain that flag, explicitly handle OPTIONS requests before they hit your business routes. Add a dedicated OPTIONS handler first:

// Handle all OPTIONS preflight requests upfront
app.options('*', cors({ origin: true, credentials: true }));

// Then your existing CORS config with preflightContinue
app.use(cors({ origin: true, credentials: true, preflightContinue: true }));

This way, the OPTIONS request gets a proper CORS response and doesn't proceed to your POST route logic.

3. Verify Your API Route Setup #

Double-check that your POST routes only listen for POST requests (not app.all or other unrestricted methods). For example:

// Correct: Only processes POST requests
app.post('/your-mall-api-endpoint', (req, res) => {
  // Your business logic here
});

// Avoid: Would handle OPTIONS, GET, POST, etc.
// app.all('/your-mall-api-endpoint', (req, res) => { ... });

Unrestricted route methods will let OPTIONS requests trigger your business logic alongside POST requests, leading to duplicate actions.

4. Quick Frontend Sanity Check #

While less likely, confirm your frontend isn't accidentally sending two POST requests (e.g., from double event listeners). But since you explicitly noted one request is always OPTIONS, the issue is almost certainly server-side CORS handling.

Once you adjust the config, the OPTIONS request will be handled silently by the CORS middleware, and only your intended POST request will execute your API logic—no more confusion.

内容的提问来源于stack exchange，提问作者Jean-Pierre Carvalho