Cybersecurity glossary
What is a Preflight Request?
Learn what a CORS preflight request is, when browsers send OPTIONS before cross-origin fetches, how Access-Control headers answer them, and how to configure APIs without breaking legitimate clients.
Definition
A preflight request is an automatic OPTIONS request a browser sends before certain cross-origin HTTP requests to ask the target server whether the actual method, headers, and credentials are permitted under Cross-Origin Resource Sharing (CORS) rules.
Why preflight requests matter
Cross-origin fetch and XHR power modern SPAs, but browsers refuse to let JavaScript read arbitrary responses from other origins. CORS is the opt-in—and preflight requests are how browsers ask permission before non-simple cross-origin calls.
APIs that handle GET and POST but ignore OPTIONS look broken in production. Security teams that misconfigure Access-Control-Allow-Origin can expose authenticated data to malicious sites. Understanding preflights is essential for both shipping features and hardening APIs.
How a preflight works
Page initiates a cross-origin request
JavaScript on one origin calls an API on another with a method, header, or body that is not simple.
Browser sends OPTIONS preflight
An automatic OPTIONS request asks whether the intended method and headers are allowed.
Server responds with Access-Control headers
Allow-Origin, Allow-Methods, Allow-Headers, and optional Max-Age define the permission.
Browser evaluates the answer
If headers match the planned request, the browser proceeds; otherwise it blocks JavaScript access.
Actual request is sent or blocked
On success the real GET, POST, PUT, or DELETE runs; on failure the client sees a CORS error.
Simple vs preflighted requests
Simple GET/POST
Limited methods and headers may skip preflight when content types stay within safe defaults.
Custom headers
Authorization, X-Request-Id, and most non-simple headers trigger OPTIONS first.
Non-simple methods
PUT, PATCH, DELETE, and CONNECT commonly require preflight approval.
application/json bodies
POST with JSON often is not simple and therefore preflighted cross-origin.
Credentialed requests
withCredentials or cookies need Allow-Credentials and an explicit origin—not *.
Preflight cache
Access-Control-Max-Age reduces repeated OPTIONS for the same endpoint pattern.
Server response patterns
| Response header | Role in preflight | Common pitfall |
|---|---|---|
| Access-Control-Allow-Origin | Names which browser origins may read responses | Reflecting arbitrary Origin with credentials enabled |
| Access-Control-Allow-Methods | Lists methods permitted after preflight | Omitting PATCH or DELETE the SPA actually uses |
| Access-Control-Allow-Headers | Approves requested custom request headers | Forgetting Authorization or X-CSRF-Token |
| Access-Control-Allow-Credentials | Permits cookie and credential inclusion | Combining true with wildcard Allow-Origin |
| Access-Control-Max-Age | Caches successful preflight results in the browser | Setting very long TTL while tightening policy later |
Security checklist
- Implement explicit OPTIONS handlers on every cross-origin API route class that needs them.
- Return least-privilege Allow-Methods and Allow-Headers—never echo unlimited wildcards on sensitive APIs.
- Use explicit origin allowlists for credentialed endpoints; never reflect untrusted Origin values.
- Treat CORS as a browser read control, not server-side authorization—validate tokens on every request.
- Log preflight failures separately; they often indicate misconfigured gateways or stale CDN rules.
- Set Access-Control-Max-Age thoughtfully to balance OPTIONS load and policy agility.
- Test from a real browser origin, not only server-side integration tests.
- Document which routes are simple vs preflighted so frontend and API teams stay aligned.
Limits and pitfalls
Preflights only affect browser-based JavaScript clients. Attackers using curl, server-side proxies, or mobile native code bypass CORS entirely—your API must still authenticate and authorize every call.
Another frequent mistake is assuming a 200 on OPTIONS means the integration is secure. Overly permissive Access-Control-Allow-Origin combined with credentials can let a malicious site read authenticated JSON from a victim’s session.
Gateways and WAFs that strip or mishandle OPTIONS are a common production failure mode. Rate-limiting OPTIONS too aggressively can also break SPAs that burst preflights on load.
The practical takeaway
A preflight request is the browser’s permission check before non-simple cross-origin fetches. Servers must answer OPTIONS with accurate, least-privilege Access-Control headers or legitimate web clients will fail.
Design APIs with preflight in mind, lock down credentialed CORS deliberately, and never confuse CORS success with proof that only trusted callers can reach your backend.
Related security terms
Cross-Origin Resource Sharing (CORS)
The browser mechanism that triggers and enforces preflight checks before cross-origin reads.
Same-Origin Policy (SOP)
The default isolation rule CORS selectively relaxes after a successful preflight.
HTTP Method
OPTIONS is the method browsers use for preflight probes.
Content Security Policy (CSP)
A separate policy layer; CSP does not replace CORS preflight requirements.
Frequently asked questions
What is a preflight request in simple terms?
Before some cross-origin API calls, the browser quietly asks the server with OPTIONS whether the real request is allowed. If the server says yes with the right Access-Control headers, the browser sends the actual request.
When does the browser send a preflight?
When a cross-origin request is not a simple request—for example it uses PUT or DELETE, custom headers like Authorization, or certain content types. The browser checks CORS rules first.
What headers does a preflight include?
Key request headers include Access-Control-Request-Method and often Access-Control-Request-Headers. The server responds with Access-Control-Allow-Origin, Allow-Methods, Allow-Headers, and optionally Allow-Credentials.
Why do my API calls work in curl but fail in the browser?
curl does not enforce CORS. Browsers block JavaScript from reading responses when preflight or CORS headers are missing or too restrictive, even if the server would have returned 200.
Can preflights be cached?
Yes. Access-Control-Max-Age tells the browser how long it may reuse a successful preflight result for the same URL, method, and headers, reducing OPTIONS traffic.
Does a preflight send cookies?
Typically no for credentialed flows the preflight itself is usually sent without cookies, but credentialed actual requests require Access-Control-Allow-Credentials: true and a specific allowed origin—not a wildcard.
References
Explore authoritative guidance and frameworks related to preflight request.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.