This isn't true in general. For many requests, an OPTIONS request is sent first. If the OPTIONS request contains permissive CORS headers, then the normal reques

This isn't true in general. For many requests, an OPTIONS request is sent first. If the OPTIONS request contains permissive CORS headers, then the normal request proceeds. See: https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request https://developer.mozilla.org/en-US/docs/Glossary/Preflight_...