Comparison
CORSvsPreflight request
CORS
the request worked in curl and failed in the browser with a message about an Access-Control header.
The protocol by which a server tells the browser which other origins may read its responses, using `Access-Control-Allow-*` headers. It is entirely enforced by the browser and entirely configured on the server, which is why no amount of client-side code fixes a CORS error. Wildcarding the allowed origin is fine for public data and forbidden with credentials, which is where most misconfigurations start.
Full entry →Preflight request
the network panel shows an OPTIONS request before your PUT, and the PUT never happened because it failed.
An automatic `OPTIONS` request the browser sends before a cross-origin request that is not simple, asking whether the method and headers are permitted. It doubles the round trips for those requests unless the response is cached with `Access-Control-Max-Age`. Adding a custom header or a JSON content type to a request that did not need one before is the usual way a working call suddenly acquires a preflight.
Full entry →