Simple request

A cross-origin request that avoids preflight because its method and headers are on a safelist — GET, HEAD or POST, with only a few content types and no custom headers. The safelist exists because those requests were already possible before CORS, via forms and image tags. It is why a form-encoded POST reaches the server whether or not CORS is configured, and why CSRF protection cannot rely on the same-origin policy.