Question 1

How do you avoid CORS preflight requests?

Accepted Answer

Use only GET/POST/HEAD with safe Content-Types and no custom headers. In practice, this is rarely possible for modern APIs (JSON + Authorization). Instead, configure the server to handle preflight correctly with Access-Control-Max-Age to cache the result.

Question 2

What is a simple CORS request?

Accepted Answer

GET, POST, or HEAD with a safe Content-Type (form-urlencoded, multipart, text/plain) and no custom headers. The browser sends it directly without a preflight and checks the response headers.

Question 3

What is a non-simple CORS request?

Accepted Answer

PUT, DELETE, PATCH, or any request with application/json Content-Type or custom headers (Authorization, X-Custom). These trigger a preflight OPTIONS request before the actual request.

Question 4

Does a fetch with application/json trigger a preflight?

Accepted Answer

Yes. application/json is not a 'safe' Content-Type. The browser sends an OPTIONS preflight first. Only form-urlencoded, multipart/form-data, and text/plain are safe.

How do you avoid CORS preflight requests?

More FAQs in CORS: Simple vs Non-Simple Requests

Still have questions?

Want to upskill yourself?

Small steps. Big possibilities.

Our courses are taking a Coffee break, but your curiosity shouldn't. Stay engaged with namastedev linkedin, youtube, discord and other resources while you wait.