should preflight request return 204 instead of 404 when origin not match?

[atian25]

Background

If a browser sends an OPTIONS request, but origin it not match, now koajs/cors will return 404 status code, due to https://github.com/koajs/cors/blob/master/index.js#L60

then the browser will warn 404, some user will confuse if they need to register an OPTION router.

Discuss

should it return 204 here?

I don't find any clear description at SPEC:

https://www.w3.org/TR/cors 7.1.5 Cross-Origin Request with Preflight

and according to spec below, OPTIONS should never return 404.

• https://tools.ietf.org/html/rfc7231#section-4.3.7 Responses to the OPTIONS method are not cacheable.
• https://tools.ietf.org/html/rfc7231#section-6.5.4 : A 404 response is cacheable by default;

and Express will return 204, https://github.com/expressjs/cors/blob/master/lib/index.js#L178