Update S3-CORS.md

S3-CORS.md

@@ -37,6 +37,7 @@ A CORS configuration consists of one or more CORS rules. Each rule defines:
 - **ID** (optional): A unique identifier for the rule
 - **AllowedOrigin** (required): Specifies which origins are allowed to access the bucket
 - **AllowedMethod** (required): HTTP methods that are allowed (GET, PUT, POST, DELETE, HEAD)
+  - **Note**: Do NOT include `OPTIONS` in AllowedMethods - it is automatically handled for preflight requests
 - **AllowedHeader** (optional): Headers that are allowed in the actual request
 - **ExposeHeader** (optional): Headers that browsers can access from the response
 - **MaxAgeSeconds** (optional): How long browsers can cache the preflight response
@@ -347,10 +348,11 @@ For actual requests (GET, POST, PUT, DELETE, etc.), SeaweedFS:
 
 ### Common Issues
 
-1. **CORS policy error**: Check that your origin is listed in `AllowedOrigins`
-2. **Method not allowed**: Ensure the HTTP method is in `AllowedMethods`
-3. **Header blocked**: Add required headers to `AllowedHeaders`
-4. **Preflight failure**: Verify all preflight requirements are met
+1. **Invalid HTTP method: OPTIONS**: Do NOT include `OPTIONS` in `AllowedMethods` - it is automatically handled for CORS preflight requests. Only use: GET, PUT, POST, DELETE, HEAD
+2. **CORS policy error**: Check that your origin is listed in `AllowedOrigins`
+3. **Method not allowed**: Ensure the HTTP method is in `AllowedMethods`
+4. **Header blocked**: Add required headers to `AllowedHeaders`
+5. **Preflight failure**: Verify all preflight requirements are met
 
 ### Debugging Tips