What Is a Preflight Request? – Definition and How It Works

Learn what triggers a CORS preflight, what the OPTIONS request asks, how caching reduces them, and why preflight failures are confusing.

A preflight is an automatic OPTIONS request a browser sends before certain cross-origin requests, asking the server whether the real request is permitted.

1. Why It Exists

Some cross-origin requests could change state before the browser learns they were disallowed. Preflighting asks permission first, so a request that would be refused never reaches the server as a real operation.

The browser sends it automatically; page code never issues it.

2. What Triggers One

A request is "simple" — and skips preflight — only if it uses GET, HEAD, or POST, carries no unusual headers, and uses a basic content type such as form encoding or plain text.

That last row catches nearly every modern API call, which is why preflights are so common.

3. What the Preflight Asks

OPTIONS /api/v1/items HTTP/1.1
Origin: https://app.example.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type, authorization

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400

Every header the real request will send must appear in the allowed list, or the browser blocks it.

4. Caching Preflights

Access-Control-Max-Age tells the browser how long it may reuse the answer. Without it, an extra round trip precedes every request, which is a visible latency cost on chatty applications.

Browsers cap the value regardless of what is sent, but setting it is still worthwhile.

5. Why Failures Are Confusing

The console reports a CORS error on the real request, while the actual failure was the preflight. Two consequences follow:

• The real request never happened, so server logs show only an OPTIONS.
• Adding a header to "fix" it can make things worse if that header is not in the allowed list.

Checking whether the OPTIONS succeeded is the first diagnostic step.

6. Credentials Change the Rules

When a request includes cookies or authorisation, the server must return Access-Control-Allow-Credentials: true and name the exact origin — the wildcard is forbidden in that mode.

A configuration that works without credentials and fails with them is almost always this.

7. Fixing Preflight Problems

1. Confirm the server routes OPTIONS at all — many frameworks do not by default.
2. Return the exact origin, not a wildcard, when credentials are involved.
3. List every header the real request sends.
4. List the method being used.
5. Set a max age to avoid a preflight per request.

8. Summary

A preflight is an automatic OPTIONS request asking whether a cross-origin request is allowed, triggered by non-simple methods, custom headers, an authorisation header, or a JSON content type.

Failures surface as errors on the real request even though it never ran, so check the OPTIONS first — and remember that credentials forbid the wildcard origin.

Potential Related Glossary

• Parsing
• Axios
• Browser Fingerprints
• Data Structure