Understanding CORS Preflight Requests

Short summary

Browsers send an OPTIONS preflight request before certain cross-origin requests to verify the server will accept the actual request, preventing unintended side effects from methods like DELETE or PUT. CORS controls response access, while preflight controls whether the request is sent at all. Preflight is only triggered for non-simple requests, which will be covered in a follow-up article.

• •Preflight requests protect servers from side-effecting cross-origin calls before they execute
• •CORS governs response access; preflight governs whether the request is sent
• •Only non-simple cross-origin requests trigger preflight

Generated with AI, which can make mistakes.