CORS preflight
termweb devsecurity
The OPTIONS request a browser sends first, asking the server's permission, before it is willing to send certain cross-origin requests at all.
A cross-origin request only skips the preflight when it is "simple": method GET, HEAD, or POST, with safelisted headers and content types. Anything else - PUT, DELETE, PATCH, the new QUERY, or a custom header like Authorization - makes the browser first send OPTIONS with Access-Control-Request-Method and -Headers; only if the server answers with matching Access-Control-Allow-* headers does the real request follow. Most "blocked by CORS" errors are actually a preflight the server answered badly or not at all, and Access-Control-Max-Age is how servers let browsers cache the permission instead of asking before every request.
Also known as: preflight, preflight request, OPTIONS preflight