I have a small Web API app up on a web server, with one GET method that returns 3 records, and a POST method that accepts an object and then assigns it an ID and returns the same object.

I'm making ajax calls from a local web app, and testing out my CORS implementation. Almost everything so far, is working well. If I don't specify an Access-Control-Allow-Origin (just set to * for now), my calls are disallowed (what I expect), but I also tried specifying Access-Control-Allow-Methods and it doesn't seem like my input restricts specific calls from being made.

For example, this is what my web.config contains:

<httpProtocol>
  <customHeaders>
    <clear />
    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Headers" value="Content-Type, Authorization, Accept, X-Requested-With " />
    <add name="Access-Control-Allow-Methods" value="OPTIONS, GET" />
  </customHeaders>
</httpProtocol>

I only have OPTIONS and GET listed, but I am still able to make POST requests. Likewise, if I set it it "OPTIONS, POST" I am still able to make GET requests.

EDIT

Based on the answer from @geekonaut below I was able to see this function as I'd expect. I attempted to try a PUT request, rather than GET or POST, but then I got an error that the OPTIONS (preflight) request wasn't allowed. I first needed to add a section in my Global.asax.cs file to accept that method, then if I toggled adding/removing PUT in my web.config's Access-Control-Allow-Methods value, I saw that it would only allow that method if it was listed.

protected void Application_OnBeginRequest()
{
    if (HttpContext.Current.Request.HttpMethod == "OPTIONS")
    {
        HttpContext.Current.Response.StatusCode = 200;
        HttpContext.Current.Response.End();
    }
}