CORS Preflight
What is a CORS preflight request, and when does the browser send OPTIONS?
Answers use simple, clear English.
Quick interview answer
For cross-origin requests that are not simple (custom headers, non-GET/POST, JSON content-types, etc.), browsers send an OPTIONS preflight asking if the actual method/headers are allowed. The server must respond with Access-Control-Allow-* headers. Same-origin requests skip CORS.
Detailed answer
For cross-origin requests that are not simple (custom headers, non-GET/POST, JSON content-types, etc.), browsers send an OPTIONS preflight asking if the actual method/headers are allowed. The server must respond with Access-Control-Allow-* headers. Same-origin requests skip CORS. CORS is a browser security feature, not an API auth mechanism — attackers can still call APIs from non-browser clients.
Full explanation
CORS is a browser security feature, not an API auth mechanism — attackers can still call APIs from non-browser clients.
Real example & use case
SPA on app.example.com calling api.example.com with Authorization header triggers preflight.
Pros & cons
Pros: stops casual cross-site reads from malicious pages. Cons: misconfigured Allow-Origin * with credentials is invalid/dangerous; debugging OPTIONS is painful.