3 ms·

Is this true if the request is a POST? Shouldn't a POST lead to a preflight request, and then the browser refusing to send the real request?

• greenshackle2 7y ago
  POST requests are not necessarily preflighted. If they used non-standard headers or content-type it would be. https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simpl...
• shiado 7y ago
  The designers of CORS kept the previous security for certain types of POST requests because they are basically equivalent to how forms work, which operate at a much worse security standard and are a source of a great number of CSRF problems. The simplest way to remember it is that most things which break the legacy behavior of POST triggers the preflight. Speaking of form problems last I checked HN has a login CSRF.
• paulddraper 7y ago
  It will trigger preflight if POST and not a form content type. (E.g. a POST application/json)