Dev.Lib
arrow_backBack to Blogs
LEVEL_011.8June 27, 20261 min read

CORS preflight

Frontend Fundamentals

"Simple" requests skip preflight; non-simple methods, custom headers, or non-simple content-types trigger `OPTIONS`.

Summary

"Simple" requests skip preflight; non-simple methods, custom headers, or non-simple content-types trigger OPTIONS. Server must echo Access-Control-Allow-Origin and allowed methods/headers. Credentials require explicit Access-Control-Allow-Credentials: true and non-wildcard origin. Debug with Network tab — failed preflight never reaches your handler. See also 5.9 SameSite cookie modes, 6.9 CORS preflight internals.

Code example

await fetch('https://api.example.com/data', {
  method: 'PUT',
  headers: { 'Content-Type': 'application/json', 'X-Custom': '1' },
  credentials: 'include',
});
// Browser sends OPTIONS preflight before PUT

Key points

  • "Simple" requests skip preflight; non-simple methods, custom headers, or non-simple content-types trigger OPTIONS.
  • Server must echo Access-Control-Allow-Origin and allowed methods/headers.
  • Credentials require explicit Access-Control-Allow-Credentials: true and non-wildcard origin.
  • Debug with Network tab — failed preflight never reaches your handler.
  • See also 5.9 SameSite cookie modes, 6.9 CORS preflight internals.

Further reading

Related concepts