CodePark/ questions / CORS
START PRACTICINGPRACTICE
Backend question · HTTP & API design › CORS

Which cross-origin fetch from a page triggers a CORS preflight?

POST with Content-Type: application/json

A POST with Content-Type: application/json triggers a preflight. A simple request skips the preflight. A request is simple only when all of these are true:
• the method is GET, HEAD or POST

• it uses only safelisted headers

• its
Content-Type is application/x-www-form-urlencoded, multipart/form-data or text/plain

application/json is not on that list. So a JSON POST gets a preflight, even though the method is POST. The other options, like "POST with Content-Type: application/x-www-form-urlencoded", are simple requests.