Skip to content
uencoder

CORS Preflight

A CORS preflight is the browser security step of sending an OPTIONS request before a "non-simple" cross-origin request, asking the server whether the actual request is permitted.

Purpose

It obtains server authorization before a cross-origin request with potential side effects can fire, preventing cross-origin CSRF and data leakage.

Mechanism

For cross-origin requests with custom headers or non-simple methods, the browser first sends OPTIONS carrying Origin and Access-Control-Request-Method/Headers. The server replies with Access-Control-Allow-Origin/Methods/Headers; once the preflight passes, the actual request is sent.

Use cases

  • Cross-origin API calls
  • Cross-origin requests with custom headers
  • Non-GET cross-origin requests

Related tools

HTTP Status Codes
Reference table of common HTTP status codes (1xx-5xx) with names, categories, and descriptions. Free, private, and 100% client-side.
TOOL
URL Parser
Parse a URL into its components: protocol, host, path, query, hash, port, username, and password. Free, private, and 100% client-side.
TOOL

References