Preflight requests?

• For certain CORS requests (e.g., methods other than GET/POST or custom

headers), browsers send an OPTIONS request first, called a preflight.

• The server must respond with allowed methods, headers, and origins.
• Properly configured CORS policies handle preflight requests automatically.