3 ms·
> Cross site POST calls require a CORS pre-flight options request, and the response of this request is scrutinized. Not in all cases. Certain POST requests co
by luhn 5y ago
> Cross site POST calls require a CORS pre-flight options request, and the response of this request is scrutinized.
Not in all cases. Certain POST requests count as "simple" requests and no preflight check is performed. For example, a POST with application/x-www-form-urlencoded data and no extra headers doesn't need a preflight, because you could make an equivalent request with an HTML form.
https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...
- deleted 5y ago[deleted]
- capableweb 5y agoAnd continuing on that note, non-simple cross-origin GET requests initiated via JS also requires a pre-flight OPTIONS request (actually any non-simple HTTP request would require this). See https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...