Dev.Lib
arrow_backBack to Blogs
LEVEL_066.9June 27, 20261 min read

CORS preflight internals

Web Security

Browser sends OPTIONS; server responds with allowed origin/methods/headers/max-age.

Summary

Browser sends OPTIONS; server responds with allowed origin/methods/headers/max-age. Preflight cache (Access-Control-Max-Age) reduces OPTIONS traffic. Custom headers like Authorization trigger preflight. Cannot fix CORS purely client-side. See 1.8 for basics; this is server contract debugging (204/200, echo exact header names).

Code example

// Server must respond to OPTIONS with matching headers
/*
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400
*/

Key points

  • Browser sends OPTIONS; server responds with allowed origin/methods/headers/max-age.
  • Preflight cache (Access-Control-Max-Age) reduces OPTIONS traffic.
  • Custom headers like Authorization trigger preflight.
  • Cannot fix CORS purely client-side.
  • See 1.8 for basics; this is server contract debugging (204/200, echo exact header names).

Further reading

Related concepts