Why does the browser send an OPTIONS request before my actual API call?

The browser sends a preflight OPTIONS request when it detects that a cross-origin request is 'non-simple' according to the CORS specification. This happens when you use methods other than GET/HEAD/POST, include custom headers like Authorization or X-API-Key, or set Content-Type to application/json. The preflight asks the server whether it permits the intended cross-origin request before the browser sends the actual request with your data.

How can I reduce the performance impact of preflight requests?

Set Access-Control-Max-Age to a high value (86400 seconds) so browsers cache preflight results and skip redundant OPTIONS requests. Note that browsers cap this value (Chrome: 2 hours, Firefox: 24 hours, Safari: 10 minutes). Additionally, consolidate API calls to reduce the number of unique endpoints needing preflight, avoid unnecessary custom headers, and consider serving your SPA and API from the same origin via a reverse proxy to eliminate CORS entirely.

What status code should the server return for preflight OPTIONS requests?

Return 204 No Content with an empty body. This is semantically correct because the preflight response carries its information entirely in headers, not in a body. While 200 OK also works, 204 is preferred. Some servers accidentally return 405 Method Not Allowed because they have no explicit OPTIONS handler for the route, which causes the preflight to fail and the browser to block the actual request.

Why does a simple GET request not require preflight but adding an Authorization header triggers one?

The CORS specification defines a set of 'CORS-safelisted' request headers that do not trigger preflight: Accept, Accept-Language, Content-Language, Content-Type (with restrictions), and Range. The Authorization header is not in this safelist because it carries authentication credentials that could have security implications if sent cross-origin without server approval. Any header outside the safelist triggers a preflight so the server can explicitly opt in to receiving it.

Does preflight caching work across different API endpoints on the same server?

No. Preflight cache entries are specific to the exact combination of URL, HTTP method, and requested headers. A cached preflight for POST /api/users with Content-Type and Authorization headers does not apply to POST /api/orders or to GET /api/users. Each unique combination requires its own preflight request the first time. This is why setting a high Max-Age is important — it ensures each endpoint only needs one preflight per cache period.

Browser Preflight Requests and OPTIONS