What triggers a CORS preflight OPTIONS request?

A preflight request is triggered when an HTTP request uses methods other than GET, HEAD, or POST, or when custom headers outside the CORS-safelisted set (like Authorization or custom X- headers) or Content-Type other than text/plain, multipart/form-data, or application/x-www-form-urlencoded are used.

Why does Access-Control-Allow-Origin: * fail with credentials?

The W3C CORS specification explicitly forbids wildcard (*) origins when Access-Control-Allow-Credentials is true to protect authenticated user sessions from malicious origins.

QuickCoderHub

Online CORS Preflight Simulator & Policy Tester

Simulate browser Cross-Origin Resource Sharing (CORS) preflight checks locally. Test client origin, headers, and credentials against server Access-Control headers with zero live network calls.

1. Client Request Parameters

Client Origin (Browser Page Origin)

Target API URL

HTTP Method

Credentials Mode

Request Headers (Comma-separated)

Content-Type

2. Server Access-Control Response Headers

Access-Control-Allow-Origin

Access-Control-Allow-Methods

Access-Control-Allow-Headers

Access-Control-Allow-Credentials

Access-Control-Max-Age (Seconds)

Access-Control-Expose-Headers

3. CORS Security Evaluation

Understanding CORS & Preflight Mechanics

The Same-Origin Policy (SOP) prohibits scripts running on one origin from loading resources from another origin. Cross-Origin Resource Sharing (CORS) is a browser mechanism that allows servers to selectively permit cross-origin access.

When is a Preflight OPTIONS Request Triggered?

A browser automatically issues a preflight request before the actual request if any of the following apply:

The HTTP method is not GET, HEAD, or POST (e.g. PUT, DELETE, PATCH).
The request includes custom HTTP headers (such as Authorization, X-Custom-Header).
The Content-Type is anything other than text/plain, multipart/form-data, or application/x-www-form-urlencoded (e.g. application/json).