Differences

This shows you the differences between two versions of the page.

Link to this comparison view

tech-notes:browsers:pre-flight-requests [2025/02/18 09:02] – created gerardorourketech-notes:browsers:pre-flight-requests [2025/02/18 09:20] (current) – [Setting this in an apache .htaccess config - e.g. Access-Control-Max-Age: 600 # Caches for 10 minutes] gerardorourke
Line 46: Line 46:
 ====When Is a Preflight Request NOT Needed?==== ====When Is a Preflight Request NOT Needed?====
  
-A preflight request is skipped if the request is "simple", meaning: ✅ Uses only GET, POST, or HEAD. +A preflight request is skipped if the request is "simple", meaning:  
-✅ No custom headers (except Content-Type: application/x-www-form-urlencoded, multipart/form-data, or text/plain). +  ✅ Uses only GET, POST, or HEAD. 
-✅ No authentication credentials (cookies, Authorization header).+  ✅ No custom headers (except Content-Type: application/x-www-form-urlencoded, multipart/form-data, or text/plain). 
 +  ✅ No authentication credentials (cookies, Authorization header). 
 Example of a simple request that does NOT trigger preflight: Example of a simple request that does NOT trigger preflight:
 <code> <code>
Line 67: Line 69:
 http http
 Access-Control-Max-Age: 600  # Caches for 10 minutes Access-Control-Max-Age: 600  # Caches for 10 minutes
 +</code>
 +
 C. Move API Calls to the Same Origin C. Move API Calls to the Same Origin
   * If possible, use reverse proxies to avoid CORS altogether.   * If possible, use reverse proxies to avoid CORS altogether.
Line 72: Line 76:
   * Instead of Access-Control-Allow-Origin: *, set it dynamically for allowed origins.   * Instead of Access-Control-Allow-Origin: *, set it dynamically for allowed origins.
 ________________________________________ ________________________________________
 +
 ==== Key Takeaways==== ==== Key Takeaways====
   * Preflight requests use OPTIONS to check if the main request is allowed.   * Preflight requests use OPTIONS to check if the main request is allowed.
Line 79: Line 84:
 ________________________________________ ________________________________________
  
-===== Setting this in an apache .htaccess config - e.g. Access-Control-Max-Age: 600 # Caches for 10 minutes ===== +===== apache .htaccess config ===== 
 +<code>
 <IfModule mod_headers.c> <IfModule mod_headers.c>
     Header set Access-Control-Allow-Origin "*"     Header set Access-Control-Allow-Origin "*"
Line 88: Line 93:
     Header set Access-Control-Max-Age "600"     Header set Access-Control-Max-Age "600"
 </IfModule> </IfModule>
 +</code>
  
   * Access-Control-Allow-Origin "*" → Allows all origins (Replace * with a specific domain if needed).   * Access-Control-Allow-Origin "*" → Allows all origins (Replace * with a specific domain if needed).
  • tech-notes/browsers/pre-flight-requests.1739869348.txt.gz
  • Last modified: 2025/02/18 09:02
  • by gerardorourke