What is Cross-Origin Resource Sharing (CORS), and when does the browser trigger a Preflight OPTIONS request?
Quick Revision Summary
CORS enforces origin boundaries in browsers. Non-simple requests (JSON body, custom auth headers, PUT/DELETE) require a preliminary OPTIONS preflight to verify server permission.
Interactive Practice Mode
Formulate your thoughts or take notes before revealing the model solution.
Saved automatically
Model Answer & Deep-Dive Explanation
CORS (Cross-Origin Resource Sharing) is a browser security mechanism based on the Same-Origin Policy (SOP). Two URLs have the same origin if they share identical protocol, domain, and port. When JavaScript on origin A tries to fetch data from origin B, CORS headers determine whether the browser permits the response to be read.
Preflight Requests (OPTIONS):
The browser automatically issues an HTTP OPTIONS preflight request before sending the actual request if the request is NOT a 'Simple Request'. A request triggers preflight if:
- It uses methods other than GET, POST, or HEAD (e.g.
PUT,DELETE,PATCH). - It sends custom headers other than standard CORS-safelisted headers (e.g.
Authorization,X-API-Key). - The
Content-Typeis other thanapplication/x-www-form-urlencoded,multipart/form-data, ortext/plain(e.g.application/json).
Interviewer Evaluation Points & Scoring Rubric
- 1 1. Defines same-origin policy parameters (protocol, host, port). 2. Identifies conditions that trigger preflight OPTIONS. 3. Mentions key headers (Access-Control-Allow-*).
Related Questions in Full Stack Web Development
What is Idempotency in REST APIs, and how should HTTP methods and status codes be structured?
Intermediate level • 8 views
Compare Microservices Architecture with Monolithic Architecture: Trade-offs, Scalability, and Distributed Challenges.
Advanced level • 7 views
How should client-side and server-side form validation work together?
Easy level • 6 views
What responsibilities belong to the browser, application server, and database?
Easy level • 5 views
How would you prevent a checkout retry from creating two orders?
Medium level • 4 views