For full text search please use the '?' prefix. e.g. ? Onboarding

Complex/Non-Simple CORS Requeset that triggers OPTIONS preflight

Complex/Non-Simple CORS Requests & OPTIONS Preflight

What is a Non-Simple CORS Request?

A non-simple (or complex) CORS request is any cross-origin request that doesn't meet the criteria for a "simple request". These requests trigger an automatic OPTIONS preflight request from the browser before the actual request is sent.

Simple vs Non-Simple Requests

From Simple CORS Requests (No Options Preflight)
Go to text →

Simple requests must meet ALL of the following criteria:

  • Method: Only GET, HEAD, or POST
  • Headers: Only CORS-safelisted headers like:
    • Accept
    • Accept-Language
    • Content-Language
    • Content-Type (with specific values only)
    • Origin (automatically added by browsers)
  • Content-Type: Only these values:
    • application/x-www-form-urlencoded
    • multipart/form-data
    • text/plain

Non-Simple Requests (Triggers Preflight)

Any request that violates the simple request criteria becomes non-simple:

1. Non-Simple HTTP Methods

PUT, DELETE, PATCH, OPTIONS, CONNECT, TRACE

2. Custom or Non-Safelisted Headers

Authorization
X-Requested-With
X-Custom-Header
Content-Type: application/json

3. Non-Simple Content-Types

application/json
application/xml
text/xml

The Preflight Flow

  1. Browser sends OPTIONS request to check permissions
  2. Server responds with allowed methods, headers, and origins
  3. If approved, browser sends the actual request
  4. If denied, browser blocks the request

Examples of Non-Simple Requests

These JavaScript requests would trigger OPTIONS preflight:

// Custom method
fetch('http://api.com/data', { method: 'PUT' })

// JSON content type
fetch('http://api.com/data', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({})
})

// Custom header
fetch('http://api.com/data', {
  headers: { 'Authorization': 'Bearer token' }
})

⚠️ Important Note About usage curl

curl does NOT send preflight OPTIONS requests. It only sends the exact request you specify. To see the complete CORS preflight behavior, you must test from:

  • A web browser
  • Browser developer tools
  • Testing tools that simulate browser CORS behavior

curl is useful for testing the server's response to individual requests, but won't replicate the full browser CORS flow.

Backlinks