Comparison
Preflight requestvsSimple request
Preflight request
the network panel shows an OPTIONS request before your PUT, and the PUT never happened because it failed.
An automatic `OPTIONS` request the browser sends before a cross-origin request that is not simple, asking whether the method and headers are permitted. It doubles the round trips for those requests unless the response is cached with `Access-Control-Max-Age`. Adding a custom header or a JSON content type to a request that did not need one before is the usual way a working call suddenly acquires a preflight.
Full entry →Simple request
the cross-origin POST went straight out with no preflight, because it used a form content type.
A cross-origin request that avoids preflight because its method and headers are on a safelist — GET, HEAD or POST, with only a few content types and no custom headers. The safelist exists because those requests were already possible before CORS, via forms and image tags. It is why a form-encoded POST reaches the server whether or not CORS is configured, and why CSRF protection cannot rely on the same-origin policy.
Full entry →